CVE-2016-6337: Mediawiki

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

MediaWiki 1.27.x before 1.27.1 might allow remote attackers to bypass intended session access restrictions by leveraging a call to the UserGetRights function after Session::getAllowedUserRights.

Affected products

• Mediawiki Mediawiki: version 1.27.0 only

Published 2017-04-20. Last modified 2026-06-17.