Description
Improper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation's Mediawiki - FlaggedRevs extension through 1.46.0.
Published: 2026-09-25
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Patch
AI Analysis

Impact

The FlaggedRevs extension fails to remove sensitive data from the user interface when review log entries are suppressed. As a result, the "Checked by" label that references a user who performed the review is still displayed in the page history. This leakage allows anyone who can view the page history to see details about suppressed review actions that should be hidden, constituting an information‑disclosure flaw. The weakness corresponds to CWE‑212.

Affected Systems

The flaw is present in all releases of the MediaWiki FlaggedRevs extension up to and including version 1.46.0, distributed by the Wikimedia Foundation. Users running older installations of the extension that process page revisions are potentially exposed. The vulnerability is tied to the FlaggedRevs code path that renders page histories.

Risk and Exploitability

The vendor scores this issue with a CVSS base score of 6.9, indicating a moderate impact. EPSS data is unavailable and the flaw is not currently listed in CISA's KEV catalog. Attackers can trigger the disclosure by simply accessing the page history of any flagged revision; no privileged access or additional conditions are required. Because the information exposed is a review identifier that has been suppressed, the risk is primarily to the privacy of contributors and the integrity of the review process.

Generated by OpenCVE AI on September 25, 2026 at 21:47 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the FlaggedRevs extension to any release newer than 1.46.0 that removes suppressed review information from the UI.
  • Configure the extension to suppress the "Checked by" label when review log entries are hidden, if the newer version does not already do so.
  • Review user permissions to page history and consider restricting access for users who do not need to see detailed review metadata.

Generated by OpenCVE AI on September 25, 2026 at 21:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 29 Sep 2026 21:45:00 +0000

Type Values Removed Values Added
References

Sun, 27 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
First Time appeared Wikimedia
Wikimedia mediawiki - Flaggedrevs Extension
Vendors & Products Wikimedia
Wikimedia mediawiki - Flaggedrevs Extension

Fri, 25 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 25 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Description Improper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation's Mediawiki - FlaggedRevs extension through 1.46.0.
Title "Checked by" label in page history should not be shown if the underlying review log entry is suppressed"
Weaknesses CWE-212
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N'}

Subscriptions

Wikimedia Mediawiki - Flaggedrevs Extension
cve-icon MITRE

Status: PUBLISHED

Assigner: wikimedia-foundation

Published:

Updated: 2026-09-29T21:22:40.501Z

Reserved: 2026-09-23T18:14:23.766Z

Link: CVE-2026-96879

cve-icon Vulnrichment

Updated: 2026-09-25T20:41:51.099Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-25T21:17:25.613

Modified: 2026-09-29T22:19:06.727

Link: CVE-2026-96879

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-27T11:43:25Z

Weaknesses
  • CWE-212

    Improper Removal of Sensitive Information Before Storage or Transfer