CVE-2025-12004: The Wikimedia Foundation Mediawiki - Lockdown Extension

Critical severity, CVSS 10.0. EPSS: 0.3% chance of exploitation in the next 30 days.

Incorrect Permission Assignment for Critical Resource vulnerability in The Wikimedia Foundation Mediawiki - Lockdown Extension allows Privilege Abuse. Fixed in Mediawiki Core Action APIThis issue affects Mediawiki - Lockdown Extension: from master before 1.42.

Affected products

• The Wikimedia Foundation Mediawiki - Lockdown Extension

Published 2025-10-21. Last modified 2026-06-17.