cve-2026-58517

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58517.json"
      }
    ],
    "title": "wikilambda: WikiLambda Extension: Authentication bypass due to improper input neutralization",
    "tracking": {
      "current_release_date": "2026-07-02T12:31:28+00:00",
      "generator": {
        "date": "2026-07-02T12:31:28+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.1"
        }
      },
      "id": "CVE-2026-58517",
      "initial_release_date": "2026-07-01T18:23:02.161000+00:00",
      "revision_history": [
        {
          "date": "2026-07-01T18:23:02.161000+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-07-02T11:35:20+00:00",
          "number": "2",
          "summary": "Current version"
        },
        {
          "date": "2026-07-02T12:31:28+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "Red Hat",
        "product": {
          "name": "All currently supported Red Hat products",
          "product_id": "red_hat_products",
          "product_identification_helper": {
            "cpe": "cpe:/a:redhat"
          }
        }
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-58517",
      "discovery_date": "2026-07-01T19:01:45.946722+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "red_hat_products"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in The Wikimedia Foundation Mediawiki - WikiLambda Extension. This vulnerability, caused by improper neutralization of input terminators, allows an attacker to bypass authentication. This could lead to unauthorized access to the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "other",
          "text": "This Critical flaw in the Mediawiki WikiLambda Extension allows an unauthenticated attacker to bypass authentication mechanisms due to improper input neutralization. This could lead to unauthorized access to systems where the WikiLambda Extension is deployed and enabled, posing a significant risk to data integrity and confidentiality.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "red_hat_products"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58517"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58517",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58517"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58517",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58517"
        },
        {
          "category": "external",
          "summary": "https://gerrit.wikimedia.org/r/c/1305376",
          "url": "https://gerrit.wikimedia.org/r/c/1305376"
        },
        {
          "category": "external",
          "summary": "https://phabricator.wikimedia.org/T428833",
          "url": "https://phabricator.wikimedia.org/T428833"
        }
      ],
      "release_date": "2026-07-01T18:23:02.161000+00:00",
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "red_hat_products"
          ]
        }
      ],
      "title": "wikilambda: WikiLambda Extension: Authentication bypass due to improper input neutralization"
    }
  ]
}