This vulnerability (CVE-2026-100240) in the Mediawiki TemplateSandbox Extension involves missing authorization controls, classified under CWE-862. It allows unauthorized access to certain functionalities due to insufficient enforcement of ACLs. The affected versions include all releases before 1.46.1, 1.45.5, and 1.43.10. The vendor has published the issue but has not provided explicit patch or mitigation details in the available data. No active exploitation has been documented.

The vulnerability could allow unauthorized users to access or invoke functionality that should be restricted, potentially leading to unauthorized actions within the Mediawiki TemplateSandbox Extension. The exact impact depends on the specific functionality exposed by the missing authorization controls, but it generally increases the risk of privilege escalation or unauthorized operations within affected Mediawiki installations.

Patch status is not yet confirmed — check the Wikimedia Foundation's official advisory for current remediation guidance. Until a fix is confirmed, restrict access to the TemplateSandbox Extension to trusted users only and monitor for unusual activity related to this component.