CVE-2025-67646 Details
Description
TableProgressTracking is a MediaWiki extension to track progress against specific criterion. Versions 1.2.0 and below do not enforce CSRF token validation in the REST API. As a result, an attacker could craft a malicious webpage that, when visited by an authenticated user on a wiki with the extension enabled, would trigger unintended authenticated actions through the victim's browser. Due to the lack of token validation, an attacker can delete or track progress against tables. This issue is patched in version 1.2.1 of the extension.
A cross-site request forgery (CSRF) vulnerability has been identified in the TableProgressTracking extension for MediaWiki, affecting versions through 1.2.0. The issue arises because the REST API does not properly validate CSRF tokens. This lack of validation allows an attacker to create a malicious webpage that, when accessed by an authenticated user on a wiki with the extension enabled, could perform unauthorized actions using the user's credentials. Exploitation could lead to the deletion of progress tracking data or unauthorized modifications to progress tables.
Users can update to version 1.2.1 of the TableProgressTracking extension, which addresses the CSRF vulnerability by implementing proper token validation in the REST API.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Dec 11, 2025CISA-ADP
Assessed Dec 11, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Telepedia/TableProgressTracking/commit/e2aa8c4b3bb78989c6fe39070a95a26d22b91c94 | [email protected] | Source CodeVendor |
| https://github.com/Telepedia/TableProgressTracking/security/advisories/GHSA-j24f-hw6w-cq78 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Telepedia TableProgressTracking | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 11, 2025 | New CVE Received | [email protected] |