CVE-2026-58518 is a CSRF vulnerability affecting the Mediawiki RedirectManager Extension maintained by the Wikimedia Foundation. Versions before 1.3.3 are vulnerable. The flaw allows attackers to trick authenticated users into submitting unwanted requests, potentially leading to unauthorized state changes within the application. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to low-medium impacts on confidentiality, integrity, availability, scope, and security requirements.

An attacker could exploit this vulnerability to perform unauthorized actions on behalf of legitimate users without their knowledge or consent. This could lead to unintended modifications or redirections managed by the RedirectManager Extension. However, the overall impact is rated medium, reflecting limited but non-negligible risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the Wikimedia Foundation's advisories for updates. Until a patch is available, consider implementing CSRF protections such as verifying anti-CSRF tokens or restricting access to trusted users where possible.