CVE-2026-58036
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A vulnerability in MediaWiki allows an unauthorized actor to access sensitive information through API and permission management files.
Risk Assessment
The organization risks exposure of user data, such as permission groups, which could lead to attack escalation or privacy breaches.
Recommendation
Immediately update MediaWiki to the latest patched version and review API configuration to restrict access.
Other vulnerabilities in MediaWiki
See all- CVE-2017-8815High
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules.
- CVE-2017-8814High
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attackers to replace text inside tags via a rule definition followed by 'a lot of junk.'
- CVE-2017-8810High
MediaWiki versions before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2, when a private wiki is configured, provide different error messages for failed login attempts depending on whether the username exists. This allows remote attackers to enumerate account names and conduct brute-force attacks.
- CVE-2012-4380High
MediaWiki versions before 1.18.5 and 1.19.x before 1.19.2 allow remote attackers to bypass GlobalBlocking extension IP address blocking and create an account via unspecified vectors.
- CVE-2016-6337High
MediaWiki 1.27.x before 1.27.1 might allow remote attackers to bypass intended session access restrictions by leveraging a call to the UserGetRights function after Session::getAllowedUserRights.
- CVE-2016-6335High
MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 does not generate head items in the context of a given title, allowing remote attackers to obtain sensitive information via a parse action to api.php.
- CVE-2016-6332High
MediaWiki versions before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1, when $wgBlockDisablesLogin is true, may allow remote attackers to obtain sensitive information by failing to terminate sessions when a user account is blocked.
- CVE-2016-6331High
ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title read restrictions via a parse action to api.php.
- CVE-2015-8625High
MediaWiki versions before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL library. This allows remote attackers to read arbitrary files via an @ (at sign) character in unspecified POST array parameters.
- CVE-2015-8624High
The User::matchEditToken function in MediaWiki before version 1.23.12 and 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 does not perform token comparison in constant time, allowing remote attackers to guess the edit token and bypass CSRF protection via a timing attack.
Original NVD description (English source)
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryAllUsers.Php, includes/Api/ApiQueryUsers.Php, includes/Permissions/PermissionManager.Php, includes/User/UserGroupManager.Php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS