{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/mediawiki-unspecified-versions/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-102973"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MediaWiki (unspecified versions)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["MediaWiki"],"content_html":"\u003cp\u003eMediaWiki contains an authorization bypass vulnerability (CVE-2026-102973) affecting the \u003ccode\u003eaction=emailuser\u003c/code\u003e API path. The API fails to correctly invoke the \u003ccode\u003eEmailUserAuthorizeSend\u003c/code\u003e hook, which is intended to enforce access control policies for sending emails. Consequently, if a wiki administrator has implemented an extension or policy to restrict email sending via this hook, an attacker with the base \u003ccode\u003esendemail\u003c/code\u003e permission can bypass those restrictions using the API.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability is conditional; it only impacts environments where a custom policy or extension utilizes the \u003ccode\u003eEmailUserAuthorizeSend\u003c/code\u003e hook to explicitly deny email operations. It does not affect stock core MediaWiki configurations that lack such custom hooks. Successful exploitation allows unauthorized email delivery, which could be leveraged for spam or social engineering if the underlying policy is bypassed.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory MediaWiki installations to identify if custom extensions or local policies are utilizing the \u003ccode\u003eEmailUserAuthorizeSend\u003c/code\u003e hook.\u003c/li\u003e\n\u003cli\u003eReview the official Phabricator report and upstream vendor updates for the patch addressing CVE-2026-102973.\u003c/li\u003e\n\u003cli\u003eApply the vendor-provided patch to all MediaWiki instances identified as using security-critical email authorization hooks.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-23T16:37:17Z","date_published":"2026-10-23T16:37:17Z","id":"https://feed.craftedsignal.io/briefs/2026-10-mediawiki-authorization-bypass/","summary":"An authorization bypass vulnerability in MediaWiki allows attackers to bypass EmailUserAuthorizeSend hooks via the action=emailuser API, potentially enabling unauthorized email transmission if specific security policies are implemented.","title":"MediaWiki: API Email Authorization Hook Bypass (CVE-2026-102973)","url":"https://feed.craftedsignal.io/briefs/2026-10-mediawiki-authorization-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - MediaWiki (Unspecified Versions)","version":"https://jsonfeed.org/version/1.1"}