What is GHSA-3835-4xp5-hjqc?

GHSA-3835-4xp5-hjqc is a security advisory published by GitHub Security Advisories with Critical severity. Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension...

Which CVE IDs does GHSA-3835-4xp5-hjqc cover?

GHSA-3835-4xp5-hjqc covers the following CVE IDs: CVE-2026-100240. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3835-4xp5-hjqc?

GHSA-3835-4xp5-hjqc has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

GHSA-3835-4xp5-hjqcCriticalCVSS 9.1

Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension...

Vendor

GitHub Security Advisories

Published

September 29, 2026

Last Modified

October 1, 2026

🔗 CVE IDs covered (1)

CVE-2026-100240 →

📋 Description

Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects Mediawiki - TemplateSandbox Extension: from * before 1.46.1, 1.45.5, 1.43.10.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-100240
https://gerrit.wikimedia.org/r/q/Iaf9f6e2280798af5516197257ddc0264b9ad9fb7
https://phabricator.wikimedia.org/T407974
https://github.com/advisories/GHSA-3835-4xp5-hjqc