Description
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.

This vulnerability is associated with program files includes/Api/ApiUserrights.Php.



This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
Published: 2026-07-01
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is located in the API handling of user rights within MediaWiki. An unauthenticated endpoint can reveal the identities and permission settings of users. This disclosure of confidential information falls under the CWE‑200 category and carries a CVSS score of 5.1, indicating a moderate but non‑negligible impact on confidentiality.

Affected Systems

Any installation of Wikimedia Foundation MediaWiki running a version older than 1.46.0, 1.45.4, 1.44.6, or 1.43.9 is affected. Versions newer than these releases do not contain the flaw. The vulnerability applies to private wikis where the API endpoint is accessible.

Risk and Exploitability

Based on the description, the likely attack vector is an unauthenticated HTTP request to /api.php that calls the user rights endpoint; no additional credentials or local access are required. The vulnerability is not listed in CISA KEV catalog and its EPSS score is < 1%, indicating a very low but nonzero exploitation probability. The moderate CVSS score reflects the potential for non‑destructive data leakage without requiring elevated privileges.

Generated by OpenCVE AI on July 21, 2026 at 14:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade MediaWiki to version 1.46.0 or later the /api.php endpoint for private wikis by enforcing authentication or IP whitelisting so that only authorized users can access user rights information.
  • Enforce strict access control in LocalSettings.php, ensuring that the API only returns user rights data to callers with valid credentials or a valid OAuth token.
  • Monitor API activity and investigate anomalous requests to /api.php calling the user rights endpoint.

Generated by OpenCVE AI on July 21, 2026 at 14:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6380-1 mediawiki security update
References
Link Providers
https://phabricator.wikimedia.org/T422085 cve-icon
History

Wed, 01 Jul 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Wikimedia
Wikimedia mediawiki
Vendors & Products Wikimedia
Wikimedia mediawiki

Wed, 01 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Description Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiUserrights.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
Title API identification of users on private wikis
Weaknesses CWE-200
References
Metrics cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Wikimedia Mediawiki
cve-icon MITRE

Status: PUBLISHED

Assigner: wikimedia-foundation

Published:

Updated: 2026-07-01T15:47:10.351Z

Reserved: 2026-06-27T13:32:37.577Z

Link: CVE-2026-58024

cve-icon Vulnrichment

Updated: 2026-07-01T15:47:05.038Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-21T14:30:08Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor