CVE-2026-100240: Wikimedia Foundation Mediawiki - Templatesandbox Extension

Critical severity, CVSS 9.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - TemplateSandbox Extension: from * before 1.46.1, 1.45.5, 1.43.10.

Affected products

• Wikimedia Foundation Mediawiki - Templatesandbox Extension

Published 2026-09-29. Last modified 2026-10-01.