Arch Linux Security Advisory ASA-202107-7 ========================================= Severity: Medium Date : 2021-07-01 CVE-ID : CVE-2021-35197 Package : mediawiki Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-2093 Summary ======= The package mediawiki before version 1.36.1-1 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 1.36.1-1. # pacman -Syu "mediawiki>=1.36.1-1" The problem has been fixed upstream in version 1.36.1. Workaround ========== None. Description =========== A security issue has been found in MediaWiki before version 1.36.1 that allows blocked users to purge pages. Impact ====== Blocked users could purge pages. References ========== https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimed... https://phabricator.wikimedia.org/T280226 https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/7fc84bbd23c1... https://security.archlinux.org/CVE-2021-35197