CVE-2024-47848

Vulnerability

Details

The vulnerability resides in the PageTriage extension for MediaWiki. The root cause is a logic error in the permission check order: the code first checks if the user has patroller or autopatrolled roles and returns true immediately, before checking if the user is blocked [1]. This means that a blocked user who still holds patroller permissions can bypass the block restriction and perform review or unreview actions on articles.

Exploitation

An attacker needs a MediaWiki account that has been blocked but still retains patroller or autopatrolled permissions. By navigating to a newly created or existing page, the attacker can mark it as reviewed or unreviewed, even though the block should prevent such actions [1]. The attack requires no special network position beyond normal wiki access.

Impact

Successful exploitation allows an authenticated but blocked user to bypass the intended access control. This can undermine moderation workflows, as blocked users can manipulate the review status of articles, potentially hiding problematic content or falsely marking pages as reviewed.

Mitigation

The issue has been fixed in PageTriage versions 1.39.9, 1.41.3, and 1.42.2 [2]. Users running affected versions should update immediately. No workaround is available; the fix reorders the permission checks to evaluate the block status before granting review privileges [1].