Medium severity · published Oct 18, 2025
CVE-2025-62668
Insufficient permission checks in action=growthsetmentor
6.9
CVSS
0.4%
EPSS
No
On KEV
Description
Incorrect Default Permissions vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Resource Leak Exposure.This issue affects Mediawiki - GrowthExperiments Extension: from master before 1.39.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MG
Mediawiki - GrowthExperiments Extension · The Wikimedia Foundation
master before 1.39 · source: vendor
Affected product
MG
Mediawiki - GrowthExperiments Extension
The Wikimedia Foundation
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-62668
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-62668
gerrit.wikimedia.org
https://gerrit.wikimedia.org/r/q/I29a18dbbaf7e2ce2a713233dbc6880032fec3628
phabricator.wikimedia.org
https://phabricator.wikimedia.org/T402600
More from Mediawiki - GrowthExperiments Extension
6.9
CVE-2026-39934
Growth Experiments ReassignMenteesJob runs as an infinite loop
6.9
CVE-2025-62667
Stored XSS through article extracts in GrowthExperiments
5.4
CVE-2026-22713
Stored XSS through edit summaries in GrowthExperiments