CVE-2025-32697

published 2025-04-10

CVE-2025-32697: Improper Preservation of Permissions vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files…

Priority P4 17 low 0 CVSS 4.0

AV N AC L AT N PR L UI P VC N VI N VA N SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE M U Green

Improper Preservation of Permissions vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/editpage/IntroMessageBuilder.Php, includes/Permissions/PermissionManager.Php, includes/Permissions/RestrictionStore.Php.

This issue affects MediaWiki: before 1.42.6, 1.43.1.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
debian	mediawiki	< mediawiki 1:1.43.1+dfsg-1 (forky)	mediawiki 1:1.43.1+dfsg-1 (forky)
mediawiki	mediawiki	>= 0 < 1:1.43.1+dfsg-1	1:1.43.1+dfsg-1
mediawiki	mediawiki	>= 0 < 1:1.43.1+dfsg-1	1:1.43.1+dfsg-1
wikimedia_foundation	mediawiki	< 1.42.6, 1.43.1	1.42.6, 1.43.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-281