What’s Vulnerable › Vulnerabilities

CVE-2026-0817: CampaignEvents API missing authorization exposes meeting and chat URLs

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-09 · updated 2026-06-17
• Weakness: CWE-862

Description

Missing Authorization vulnerability in Wikimedia Foundation MediaWiki - CampaignEvents extension allows Privilege Abuse.This issue affects MediaWiki - CampaignEvents extension: 1.45, 1.44, 1.43, 1.39.

Affected products

• Wikimedia Campaignevents: 1.39, 1.43, 1.44, 1.45

References

• https://gerrit.wikimedia.org/r/q/I7ed0049691258c8bd2555e599b9b88490fbe3358
• https://phabricator.wikimedia.org/T410560

Get alerted when CVE-2026-0817 or the next vulnerability affects your stack