Versions mentioned in the description apply to the upstream
Remediation section below for
Debian:9 relevant versions.
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. ContentModelChange does not check if a user has correct permissions to create and set the content model of a nonexistent page.
mediawiki to version 1:1.27.7-1~deb9u8 or higher.