-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mediawiki/core | composer | >= 1.27.0, < 1.27.6 | 1.27.6 |
| mediawiki/core | composer | >= 1.30.0, < 1.30.2 | 1.30.2 |
| mediawiki/core | composer | >= 1.31.0, < 1.31.2 | 1.31.2 |
| mediawiki/core | composer | >= 1.32.0, < 1.32.2 | 1.32.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing re-authentication enforcement in the Special:ChangeEmail handler. MediaWiki's special page architecture uses execute() as the entry point for request handling. The Phabricator task T197279 and associated patch show security fixes were applied to the execute() method to add AuthManager::securitySensitiveOperation checks. This indicates the original implementation lacked proper re-auth validation when processing email change requests via POST, making the execute() method the vulnerable entry point.