This vulnerability (CVE-2026-100378) in the Mediawiki Translate Extension is classified as CWE-862 (Missing Authorization). It permits users with limited privileges to access functionality not properly constrained by ACLs, potentially allowing unauthorized actions within the extension. The affected versions include all versions prior to 1.46.1, as well as specifically 1.45.5 and 1.43.10. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and limited impact on confidentiality and integrity. There is no vendor advisory or patch information provided, and no known exploitation in the wild.

The vulnerability allows unauthorized access to certain functionalities within the Translate Extension of Mediawiki, which could lead to unauthorized actions by users with limited privileges. The impact is rated medium severity with a CVSS score of 5.3, indicating a moderate risk. There is no indication of direct confidentiality, integrity, or availability compromise beyond the unauthorized access to functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should review user permissions and restrict access to the Translate Extension functionality where possible to limit exposure.