Description
An issue was discovered in the Translate extension in MediaWiki through 1.36. The Aggregategroups Action API module does not validate the parameter for aggregategroup when action=remove is set, thus allowing users with the translate-manage right to silently delete various groups' metadata.
Remediation
References
Related Vulnerabilities
Magento Incorrect Authorization Vulnerability (CVE-2022-34255)
Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-0129)
Internet Information Services Other Vulnerability (CVE-2002-0075)
WordPress Plugin Advanced Custom Fields PRO PHP Object Injection (6.0.7)
WordPress Plugin VikBooking Hotel Booking Engine & PMS Multiple Vulnerabilities (1.5.3)