A missing permission check in the Translate sandbox doRemind action allows an attacker to invoke functionality that should be restricted by access control lists. The flaw is classified as an Authorization vulnerability (CWE‑862) and enables unauthorized users to trigger actions that may modify translations or send reminders without proper approval.

The vulnerability impacts the MediaWiki Translate Extension supplied by the Wikimedia Foundation. Versions prior to 1.46.1, 1.45.5, and 1.43.10 are affected, meaning any deployment using the extension before these releases may be exposed.

The CVSS score of 5.3 indicates a moderate severity. Because the EPSS score is not available, the current exploitation likelihood is unknown; the vulnerability is not listed in the CISA KEV catalog. Attackers most likely can exploit the flaw from any authenticated session or possibly unauthenticated if the extension permits such access, as the missing check does not enforce proper ACLs.