CVE-2012-4404: MoinMoin Virtual Group Name Handling Vulnerability
Summary
CVE-2012-4404: security/init.py in MoinMoin 1.9 through 1.9.4 does not properly handle group names that contain virtual group names such as "All," "Known," or "Trusted," which allows remote authenticated users with virtual group member... Affects moin versions >= 1.9, < 1.9.5. Fixed in 1.9.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MoinMoin is an open-source wiki engine written in Python. It provides a platform for collaborative content creation and editing. The vulnerability affects MoinMoin versions 1.9 through 1.9.4. MoinMoin uses group names to manage user permissions and access control. However, the security/init.py module in MoinMoin does not properly handle group names that contain virtual group names such as "All," "Known," or "Trusted." This flaw allows remote authenticated users with virtual group membership to be treated as a member of the group.
Vulnerability Detail
The vulnerability arises from the improper handling of group names containing virtual group names in MoinMoin. When a user with virtual group membership is authenticated, they can exploit this flaw to gain unauthorized access to resources or perform actions that should be restricted to specific groups. This vulnerability can lead to privilege escalation and unauthorized data manipulation within the affected MoinMoin instance.
How To Fix
Latest published version: 1.9.11 as of 22 Oct 2026
pip install --upgrade "moin==1.9.11"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.5
This is the first release that contains the fix.
pip install --upgrade "moin==1.9.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability.
Conclusion
The MoinMoin Virtual Group Name Handling Vulnerability (CVE-2012-4404) affects MoinMoin versions 1.9 through 1.9.4. It allows remote authenticated users with virtual group membership to be treated as members of the group, leading to unauthorized access and potential privilege escalation. Upgrading to MoinMoin version 1.9.5 or later is recommended to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moin →
FAQ
The vulnerability allows remote authenticated users with virtual group membership to gain unauthorized access and perform actions that should be restricted to specific groups.
MoinMoin versions 1.9 through 1.9.4 are affected by this vulnerability.
You can use the Vulert playground (https://vulert.com/scanner) to check if your MoinMoin instance is affected by this vulnerability. Simply provide your Pipfile.lock for analysis.
No specific workaround has been provided for this vulnerability.
You can find more information about this vulnerability in the MoinMoin advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/moin/PYSEC-2012-10.yaml
Related vulnerabilities
Recent vulnerabilities recorded for moin.
