Skip to content
OpenAdvisories
Medium · 6.9 CVE-2025-62669 EUVD-2025-34957GHSA-54m9-295v-m438

UserInfoCard: activeLocalBlocksAllWikis does not do permissions checks

Published Oct 18, 2025 · Updated Oct 20, 2025 · Assigned by wikimedia-foundation

Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resource Leak Exposure.This issue affects Mediawiki - CentralAuth Extension: from master before 1.39.

Affected products

VendorProductAffectedFixed
The Wikimedia Foundation Mediawiki - CentralAuth Extension master – < 1.39 1.39

Advisories 1

References