MediaWiki (Unspecified Versions) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/mediawiki-unspecified-versions/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 23 Oct 2026 16:37:17 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMediaWiki: API Email Authorization Hook Bypass (CVE-2026-102973)https://feed.craftedsignal.io/briefs/2026-10-mediawiki-authorization-bypass/Fri, 23 Oct 2026 16:37:17 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-mediawiki-authorization-bypass/An authorization bypass vulnerability in MediaWiki allows attackers to bypass EmailUserAuthorizeSend hooks via the action=emailuser API, potentially enabling unauthorized email transmission if specific security policies are implemented.MediaWiki contains an authorization bypass vulnerability (CVE-2026-102973) affecting the action=emailuser API path. The API fails to correctly invoke the EmailUserAuthorizeSend hook, which is intended to enforce access control policies for sending emails. Consequently, if a wiki administrator has implemented an extension or policy to restrict email sending via this hook, an attacker with the base sendemail permission can bypass those restrictions using the API.

Impact

The vulnerability is conditional; it only impacts environments where a custom policy or extension utilizes the EmailUserAuthorizeSend hook to explicitly deny email operations. It does not affect stock core MediaWiki configurations that lack such custom hooks. Successful exploitation allows unauthorized email delivery, which could be leveraged for spam or social engineering if the underlying policy is bypassed.

Recommendation

  • Inventory MediaWiki installations to identify if custom extensions or local policies are utilizing the EmailUserAuthorizeSend hook.
  • Review the official Phabricator report and upstream vendor updates for the patch addressing CVE-2026-102973.
  • Apply the vendor-provided patch to all MediaWiki instances identified as using security-critical email authorization hooks.
]]>mediumadvisory