High · 7.5 CVE-2026-100241 EUVD-2026-89071GHSA-hm8p-x35f-6gwh

Private change tags exposed to anonymous users via revision-tags-change events

Published Sep 29, 2026 · Updated Sep 30, 2026 · Assigned by wikimedia-foundation

Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - EventBus Extension allows Excavation.

This issue affects Mediawiki - EventBus Extension: 1.47.0-alpha.

Vendor	Product	Affected	Fixed
Wikimedia Foundation	Mediawiki - EventBus Extension	1.47.0-alpha	—