CVE-2021-41801: Mediawiki

High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days.

The ReplaceText extension through 1.41 for MediaWiki has Incorrect Access Control. When a user is blocked after submitting a replace job, the job is still run, even if it may be run at a later time (due to the job queue backlog)

Affected products

• Mediawiki Mediawiki: before 1.31.16 (fixed in 1.31.16); from 1.35.0, before 1.35.4 (fixed in 1.35.4); from 1.36.0, before 1.36.2 (fixed in 1.36.2)

Published 2021-10-11. Last modified 2026-06-17.