Page MenuHomePhabricator

CVE-2026-58517: Blocked users can create and edit WikiLambda objects
Closed, ResolvedPublicSecurity

Description

When experimenting with WikiLambda locally, I noticed that the check at https://github.com/wikimedia/mediawiki-extensions-WikiLambda/blob/4b79c3a9a148cf73d37c5754c940398d72f32486/includes/Special/SpecialCreateObject.php#L76 is not working correctly: $block->appliesToRight( 'createpage' ) always returns null and therefore bypasses the check. The logic in AbstractBlock always returns null for createpage (at least if $wgBlockDisablesLogin is false, which is the case on public wikis). DatabaseBlock also doesn't recognize createpage because it is not in BlockActionInfo::getAllBlockActions() (which I verified by checking the valid values for the actionrestrictions of action=block at Special:ApiSandbox). Therefore, SpecialCreateObject::userCanExecute() is always true if the user has the permission but is blocked.

However, this check only restricts the frontend. The API (action=wikilambda_edit/ApiZObjectEditor) does not check for blocks at all; ZObjectAuthorization::authorize only calls Authority::isAllowed(), and according to the docs, This method will not apply rate limit checks or evaluate user blocks..

Reproduction steps

I performed the following steps locally:

  • Grant your alt account a group with the wikilambda-create permission
  • Create a sitewide block at Special:Block for your alt
  • Log into your alt and go to /wiki/Special:ApiSandbox#action=wikilambda_edit&format=json&summary=Test%20summary&zobject=%7B%22Z1K1%22%3A%22Z2%22%2C%22Z2K1%22%3A%7B%22Z1K1%22%3A%22Z6%22%2C%22Z6K1%22%3A%22Z0%22%7D%2C%22Z2K2%22%3A%22%22%2C%22Z2K3%22%3A%7B%22Z1K1%22%3A%22Z12%22%2C%22Z12K1%22%3A%5B%22Z11%22%2C%7B%22Z1K1%22%3A%22Z11%22%2C%22Z11K1%22%3A%22Z1002%22%2C%22Z11K2%22%3A%22Test%20object%202%22%7D%5D%7D%2C%22Z2K4%22%3A%7B%22Z1K1%22%3A%22Z32%22%2C%22Z32K1%22%3A%5B%22Z31%22%5D%7D%2C%22Z2K5%22%3A%7B%22Z1K1%22%3A%22Z12%22%2C%22Z12K1%22%3A%5B%22Z11%22%2C%7B%22Z1K1%22%3A%22Z11%22%2C%22Z11K1%22%3A%22Z1002%22%2C%22Z11K2%22%3A%22Test%20description%22%7D%5D%7D%7D&token=c4de66c7d54d7619a65beda7153ab4996a2a03df%2B%5C&formatversion=2
  • Click "Make request" (and click the button to correct the token)

The object was created despite the alt account being blocked and not being able to edit any other pages.

Additional information

MW: 1.47.0-alpha (639bcdd)
WikiLambda: 4b79c3a

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript
Jdforrester-WMF changed the task status from Open to In Progress.Jun 15 2026, 8:43 PM
Jdforrester-WMF claimed this task.

Proposed fix, including tests:

Proposed fix, including tests:

CR+2

Mstyles moved this task from Security Patch To Deploy to Watching on the Security-Team board.
Mstyles subscribed.

Proposed fix, including tests:

Deployed

Any reason this patch can't actually go through gerrit? It's not a bundled extension etc.

Security release due this week, so would be good to start clearing up the WMF deployed board

Change #1305376 merged by jenkins-bot:

[mediawiki/extensions/WikiLambda@master] SECURITY: ZObjectAuthorization: Manually check blocks

https://gerrit.wikimedia.org/r/1305376

Any reason this patch can't actually go through gerrit? It's not a bundled extension etc.

Security release due this week, so would be good to start clearing up the WMF deployed board

Now landed in master: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/WikiLambda/+/1305376

Change #1306754 had a related patch set uploaded (by Mstyles; author: Jforrester):

[mediawiki/extensions/WikiLambda@REL1_46] SECURITY: ZObjectAuthorization: Manually check blocks

https://gerrit.wikimedia.org/r/1306754

Change #1306754 abandoned by Mstyles:

[mediawiki/extensions/WikiLambda@REL1_46] SECURITY: ZObjectAuthorization: Manually check blocks

https://gerrit.wikimedia.org/r/1306754

Mstyles renamed this task from Blocked users can create and edit WikiLambda objects to CVE-2026-58517: Blocked users can create and edit WikiLambda objects.Jul 1 2026, 6:25 PM
Mstyles removed a project: Patch-For-Review.
Mstyles changed the visibility from "Custom Policy" to "Public (No Login Required)".
Mstyles changed the edit policy from "Custom Policy" to "All Users".
Mstyles moved this task from Watching to Our Part Is Done on the Security-Team board.