CVE-2026-0817

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0817", "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "state": "PUBLISHED", "assignerShortName": "wikimedia-foundation", "dateReserved": "2026-01-09T15:44:08.294Z", "datePublished": "2026-01-09T15:50:50.616Z", "dateUpdated": "2026-01-09T17:37:36.036Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "MediaWiki - CampaignEvents extension", "repo": "https://gerrit.wikimedia.org/g/mediawiki/extensions/CampaignEvents", "vendor": "Wikimedia Foundation", "versions": [{"status": "affected", "version": "1.45"}, {"status": "affected", "version": "1.44"}, {"status": "affected", "version": "1.43"}, {"status": "affected", "version": "1.39"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in Wikimedia Foundation MediaWiki - CampaignEvents extension allows Privilege Abuse.<p>This issue affects MediaWiki - CampaignEvents extension: 1.45, 1.44, 1.43, 1.39.</p>"}], "value": "Missing Authorization vulnerability in Wikimedia Foundation MediaWiki - CampaignEvents extension allows Privilege Abuse.This issue affects MediaWiki - CampaignEvents extension: 1.45, 1.44, 1.43, 1.39."}], "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 Privilege Abuse"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "shortName": "wikimedia-foundation", "dateUpdated": "2026-01-09T15:50:50.616Z"}, "references": [{"url": "https://phabricator.wikimedia.org/T410560"}, {"url": "https://gerrit.wikimedia.org/r/q/I7ed0049691258c8bd2555e599b9b88490fbe3358"}], "source": {"discovery": "UNKNOWN"}, "title": "CampaignEvents API missing authorization exposes meeting and chat URLs", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-01-09T17:35:46.425216Z", "id": "CVE-2026-0817", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-09T17:37:36.036Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-0817", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-09T17:35:46.425216Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-09T17:37:30.348Z"}}], "cna": {"title": "CampaignEvents API missing authorization exposes meeting and chat URLs", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 Privilege Abuse"}]}], "affected": [{"repo": "https://gerrit.wikimedia.org/g/mediawiki/extensions/CampaignEvents", "vendor": "Wikimedia Foundation", "product": "MediaWiki - CampaignEvents extension", "versions": [{"status": "affected", "version": "1.45"}, {"status": "affected", "version": "1.44"}, {"status": "affected", "version": "1.43"}, {"status": "affected", "version": "1.39"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://phabricator.wikimedia.org/T410560"}, {"url": "https://gerrit.wikimedia.org/r/q/I7ed0049691258c8bd2555e599b9b88490fbe3358"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Wikimedia Foundation MediaWiki - CampaignEvents extension allows Privilege Abuse.This issue affects MediaWiki - CampaignEvents extension: 1.45, 1.44, 1.43, 1.39.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in Wikimedia Foundation MediaWiki - CampaignEvents extension allows Privilege Abuse.<p>This issue affects MediaWiki - CampaignEvents extension: 1.45, 1.44, 1.43, 1.39.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "shortName": "wikimedia-foundation", "dateUpdated": "2026-01-09T15:50:50.616Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0817", "state": "PUBLISHED", "dateUpdated": "2026-01-09T17:37:36.036Z", "dateReserved": "2026-01-09T15:44:08.294Z", "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "datePublished": "2026-01-09T15:50:50.616Z", "assignerShortName": "wikimedia-foundation"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "MediaWiki - CampaignEvents extension", "repo": "https://gerrit.wikimedia.org/g/mediawiki/extensions/CampaignEvents", "vendor": "Wikimedia Foundation", "versions": [{"status": "affected", "version": "1.45"}, {"status": "affected", "version": "1.44"}, {"status": "affected", "version": "1.43"}, {"status": "affected", "version": "1.39"}]}], "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wikimedia:campaignevents:1.39:*:*:*:*:mediawiki:*:*", "matchCriteriaId": "0B6BEF5F-A467-4230-A440-87D592FD7744", "vulnerable": true}, {"criteria": "cpe:2.3:a:wikimedia:campaignevents:1.43:*:*:*:*:mediawiki:*:*", "matchCriteriaId": "2537B774-AB5F-478B-83B3-692B54EEC11F", "vulnerable": true}, {"criteria": "cpe:2.3:a:wikimedia:campaignevents:1.44:*:*:*:*:mediawiki:*:*", "matchCriteriaId": "1B99FC40-65D2-4940-AEF2-7FC9C8E5706D", "vulnerable": true}, {"criteria": "cpe:2.3:a:wikimedia:campaignevents:1.45:*:*:*:*:mediawiki:*:*", "matchCriteriaId": "6EBE5683-3C99-4FF6-BA80-F016F23B1CED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Wikimedia Foundation MediaWiki - CampaignEvents extension allows Privilege Abuse.This issue affects MediaWiki - CampaignEvents extension: 1.45, 1.44, 1.43, 1.39."}, {"lang": "es", "value": "Vulnerabilidad de autorizaci\u00f3n faltante en la extensi\u00f3n CampaignEvents de Wikimedia Foundation MediaWiki permite el abuso de privilegios. Este problema afecta a la extensi\u00f3n CampaignEvents de MediaWiki: 1.45, 1.44, 1.43, 1.39."}], "id": "CVE-2026-0817", "lastModified": "2026-06-17T10:11:26.027", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0817", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-09T17:35:46.425216Z", "version": "2.0.3"}}]}, "published": "2026-01-09T16:16:08.030", "references": [{"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "tags": ["Patch"], "url": "https://gerrit.wikimedia.org/r/q/I7ed0049691258c8bd2555e599b9b88490fbe3358"}, {"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "tags": ["Issue Tracking"], "url": "https://phabricator.wikimedia.org/T410560"}], "sourceIdentifier": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T16:36:05.726593+00:00", "value": {"mitigation_remediation": ["Upgrade the CampaignEvents extension to the latest patched release or a version that includes the authorization fix.", "Restrict API access so that only authenticated users with appropriate permissions can call the endpoints that expose meeting and chat URLs.", "Review user roles and permissions in MediaWiki to ensure that only trusted administrators can manage campaign events and distribute URLs."], "summary": {"action": "Patch Immediately", "impact": "Privilege Abuse through exposed meeting and chat URLs"}, "threat_synthesis": {"affected_systems": "Affected systems include the Wikimedia Foundation's MediaWiki CampaignEvents extension in versions 1.45, 1.44, 1.43, and 1.39. Users running these versions are vulnerable until the issue is addressed.", "description_and_impact": "The CampaignEvents extension for MediaWiki contains a missing authorization check. This flaw, classified as CWE-862, allows unprivileged users to call API endpoints that return meeting and chat URLs. The exposed URLs can grant access to private resources, enabling unauthorized viewing or participation in meetings and chats.", "risk_and_exploitability": "The CVSS base score of 5.3 indicates moderate severity, while an EPSS score of less than 1\u202f% suggests a low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that attackers could exploit the flaw remotely by sending crafted API requests to exposed endpoints, assuming no prior authorization constraints. Given the low exploitation likelihood, administrators should prioritize applying an official fix and tightening access controls."}}}}, "created": "2026-01-12T14:38:10.671489+00:00", "updated": "2026-04-18T16:45:05.222565+00:00", "vendors": ["mediawiki", "mediawiki$PRODUCT$mediawiki", "wikimedia", "wikimedia$PRODUCT$mediawiki-campaignevents_extension"]}