Security readout for executives and security teams
Plain-English summary
CVE-2026-0817 is a missing-authorization issue in Wikimedia’s MediaWiki CampaignEvents extension. An unauthenticated network user may be able to access meeting and chat URLs that should require permission. The impact is limited to confidentiality, but it can expose private event coordination links.
Executive priority
Treat as a medium-priority privacy exposure. It is not described as code execution or system takeover, but it can leak private collaboration links. Prioritize internet-facing wikis and communities using CampaignEvents for sensitive meetings.
Technical view
The CVE describes CWE-862 in the CampaignEvents API. Affected extension versions are 1.45, 1.44, 1.43, and 1.39. CVSS 3.1 is 5.3: network reachable, low complexity, no privileges or user interaction, with low confidentiality impact and no stated integrity or availability impact.
Likely exposure
Exposure is likely limited to MediaWiki installations using the CampaignEvents extension in the listed versions, especially where event meeting or chat URLs are stored and expected to be restricted.
Exploitation context
The source bundle does not show CISA KEV listing or cited evidence of active exploitation. The issue is remotely reachable and unauthenticated per CVSS, so public-facing wikis with the extension deserve timely review.
Researcher notes
Evidence is limited to the CVE metadata and Wikimedia tracking references. The public record identifies missing authorization and affected versions, but the provided sources do not include full advisory text, exploit details, or a named fixed version.
Mitigation direction
- Inventory MediaWiki sites for the CampaignEvents extension and affected versions.
- Review Wikimedia Phabricator and Gerrit references for the official fix status.
- Apply the vendor-provided fixed release or patch when available.
- Restrict or remove sensitive meeting and chat URLs until authorization is confirmed.
- Review exposed event data and rotate private meeting links if disclosure is suspected.
Validation and detection
- Confirm whether CampaignEvents is installed and record its version.
- Check whether affected versions 1.45, 1.44, 1.43, or 1.39 are present.
- Verify unauthorized users cannot view event meeting or chat URLs through the API.
- Confirm the relevant Wikimedia patch or fixed release is applied.
- Review logs for unusual unauthenticated access to CampaignEvents API endpoints.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-0817 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N3.91.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://phabricator.wikimedia.org/T410560CVE reference
- https://gerrit.wikimedia.org/r/q/I7ed0049691258c8bd2555e599b9b88490fbe3358CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.