CVE-2025-67646 TableProgressTracking's missing CSRF protection allows unauthorized state changes
An attacker can force authenticated users to delete or modify table progress data via a malicious webpage due to missing CSRF protection.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-67646?
CVE-2025-67646 is a low-severity vulnerability in Telepedia TableProgressTracking, published on 10 Dec 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
TableProgressTracking is a MediaWiki extension to track progress against specific criterion. Versions 1.2.0 and below do not enforce CSRF token validation in the REST API. As a result, an attacker could craft a malicious webpage that, when visited by an authenticated user on a wiki with the extension enabled, would trigger unintended authenticated actions through the victim's browser. Due to the lack of token validation, an attacker can delete or track progress against tables. This issue is patched in version 1.2.1 of the extension.
Weakness: CWE-352
Which versions are affected by CVE-2025-67646?
How do I fix CVE-2025-67646?
No fix has been published for CVE-2025-67646 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-67646 being exploited?
There is no known exploitation of CVE-2025-67646 in the wild and no public exploit code.
Sources
Also known as GHSA-j24f-hw6w-cq78.