CVE-2026-34090

HighCVSS 7.5

Published: 11/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

A vulnerability in CheckUser at the Wikimedia Foundation allows exposure of sensitive information to unauthorized actors. It affects versions from 1.45.0 before 1.45.2.

Risk Assessment

Exposure of sensitive data may lead to privacy breaches for users and potential attacks on the system.

Recommendation

It is recommended to update CheckUser to version 1.45.2 or later to mitigate this vulnerability.

Other vulnerabilities in CheckUser

CVE-2026-58034Medium
An XSS vulnerability in the Wikimedia Foundation CheckUser extension allows an attacker to inject malicious scripts into a page. The issue is located in the Vue module file responsible for the temporary account blocking field.

Original NVD description (English source)

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation CheckUser. This issue affects CheckUser: from 1.45.0 before 1.45.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS