Description
An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. There is no rate limit for merging items.
Remediation
References
Related Vulnerabilities
WordPress Plugin WordPress Download Manager Cross-Site Scripting (3.2.21)
WordPress Plugin Student Result or Employee Database Security Bypass (1.6.3)
Dolibarr Incorrect Default Permissions Vulnerability (CVE-2020-13240)
Grafana URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2022-29170)
MediaWiki Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2026-58518)