CVE-2025-53485
SecurePoll: Unauthorized access to SetTranslationHandler allows arbitrary text changes
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
SecurePoll: Unauthorized access to SetTranslationHandler allows arbitrary text changes
SetTranslationHandler.php does not validate that the user is an election admin, allowing any (even unauthenticated) user to change election-related translation text. While partially broken in newer MediaWiki versions, the check is still missing. This issue affects Mediawiki - SecurePoll extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Reserved 2025-06-30 | Published 2025-07-04 | Updated 2025-07-04 | Assigner wikimedia-foundationphabricator.wikimedia.org/T392341
Support options
