CVE-2021-35197: Debian Linux

High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days.

In MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.35.3, and 1.36.x before 1.36.1, bots have certain unintended API access. When a bot account has a "sitewide block" applied, it is able to still "purge" pages through the MediaWiki Action API (which a "sitewide block" should have prevented).

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
• Fedoraproject Fedora: version 33 only; version 34 only; version 35 only
• Mediawiki Mediawiki: before 1.31.15 (fixed in 1.31.15); from 1.32.0, before 1.35.3 (fixed in 1.35.3); from 1.36.0, before 1.36.1 (fixed in 1.36.1)

Published 2021-07-02. Last modified 2026-06-17.