CVE-2019-12468

Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.27.0 through 1.32.1

Description The issue is related to an Incorrect Access Control vulnerability that allows for bypassing re-authentication. This can be exploited by directly POSTing to the "Special:ChangeEmail" endpoint, potentially leading to account takeover, unauthorized access to protected information, and impact on data integrity.

Recommendations For MediaWiki versions 1.27.0 through 1.32.1, consider restricting access to the "Special:ChangeEmail" endpoint until a patch is available. As a temporary workaround, disabling the re-authentication bypass functionality may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.