ArchLinux: 202107-7: mediawiki: access restriction bypass
Summary
A security issue has been found in MediaWiki before version 1.36.1 that allows blocked users to purge pages.
Resolution
Upgrade to 1.36.1-1.
# pacman -Syu "mediawiki>=1.36.1-1"
The problem has been fixed upstream in version 1.36.1.
References
https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/thread/YR3X4L2CPSEJVSY543AWEO65TD6APXHP/ https://phabricator.wikimedia.org/T280226 https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/7fc84bbd23c1205e13c7a8332ab39e6ff52ca107%5E%21/ https://security.archlinux.org/CVE-2021-35197
Workaround
None.