Lockdown Extension up to 1.41 on Mediawiki permission assignment

Summaryinfo

A vulnerability labeled as critical has been found in Lockdown Extension up to 1.41 on Mediawiki. This affects an unknown part. Executing a manipulation can lead to permission assignment. This vulnerability is tracked as CVE-2025-12004. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical was found in Lockdown Extension up to 1.41 on Mediawiki. This vulnerability affects an unknown part. The manipulation with an unknown input leads to a permission assignment vulnerability. The CWE definition for the vulnerability is CWE-732. The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Incorrect Permission Assignment for Critical Resource vulnerability in The Wikimedia Foundation Mediawiki - Lockdown Extension allows Privilege Abuse. Fixed in Mediawiki Core Action APIThis issue affects Mediawiki - Lockdown Extension: from master before 1.42.

The weakness was disclosed by Dianliang233. The advisory is available at phabricator.wikimedia.org. This vulnerability was named CVE-2025-12004 since 10/21/2025. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available.

The vulnerability scanner Nessus provides a plugin with the ID 271644 (Linux Distros Unpatched Vulnerability : CVE-2025-12004), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.42 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (271644), EUVD (EUVD-2025-35148) and CERT Bund (WID-SEC-2025-2381). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• Open Source MediaWiki

Productinfo

Name

• Lockdown Extension

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33
• 1.34
• 1.35
• 1.36
• 1.37
• 1.38
• 1.39
• 1.40
• 1.41

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion