In MediaWiki through 1.37, blocked IP addresses are allowed to edit EntitySchema items.
NVD-CWE-noinfo