MediaWiki: API Email Authorization Hook Bypass (CVE-2026-102973)

MediaWiki contains an authorization bypass vulnerability (CVE-2026-102973) affecting the action=emailuser API path. The API fails to correctly invoke the EmailUserAuthorizeSend hook, which is intended to enforce access control policies for sending emails. Consequently, if a wiki administrator has implemented an extension or policy to restrict email sending via this hook, an attacker with the base sendemail permission can bypass those restrictions using the API.

Impact

The vulnerability is conditional; it only impacts environments where a custom policy or extension utilizes the EmailUserAuthorizeSend hook to explicitly deny email operations. It does not affect stock core MediaWiki configurations that lack such custom hooks. Successful exploitation allows unauthorized email delivery, which could be leveraged for spam or social engineering if the underlying policy is bypassed.

Recommendation

• Inventory MediaWiki installations to identify if custom extensions or local policies are utilizing the EmailUserAuthorizeSend hook.
• Review the official Phabricator report and upstream vendor updates for the patch addressing CVE-2026-102973.
• Apply the vendor-provided patch to all MediaWiki instances identified as using security-critical email authorization hooks.