Critical severity · published Oct 21, 2025
CVE-2025-12004
The compare API module breaks Extension:Lockdown
10.0
CVSS
0.4%
EPSS
No
On KEV
Description
Incorrect Permission Assignment for Critical Resource vulnerability in The Wikimedia Foundation Mediawiki - Lockdown Extension allows Privilege Abuse. Fixed in Mediawiki Core Action APIThis issue affects Mediawiki - Lockdown Extension: from master before 1.42.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ML
Mediawiki - Lockdown Extension · The Wikimedia Foundation
master before 1.42 · source: vendor
Affected product
ML
Mediawiki - Lockdown Extension
The Wikimedia Foundation