A mediawiki security update has been released for Arch Linux.

ASA-202107-7: mediawiki: access restriction bypass

Arch Linux Security Advisory ASA-202107-7
========================================
Severity: Medium
Date : 2021-07-01
CVE-ID : CVE-2021-35197
Package : mediawiki
Type : access restriction bypass
Remote : Yes
Link :   https://security.archlinux.org/AVG-2093

Summary
======
The package mediawiki before version 1.36.1-1 is vulnerable to access
restriction bypass.

Resolution
=========
Upgrade to 1.36.1-1.

# pacman -Syu "mediawiki>=1.36.1-1"

The problem has been fixed upstream in version 1.36.1.

Workaround
=========
None.

Description
==========
A security issue has been found in MediaWiki before version 1.36.1 that
allows blocked users to purge pages.

Impact
=====
Blocked users could purge pages.

References
=========
  https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/thread/YR3X4L2CPSEJVSY543AWEO65TD6APXHP/
  https://phabricator.wikimedia.org/T280226
  https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/7fc84bbd23c1205e13c7a8332ab39e6ff52ca107%5E%21/
  https://security.archlinux.org/CVE-2021-35197