Skip to content
OpenAdvisories
High · 7.5 CVE-2026-100244 EUVD-2026-89090GHSA-8fvg-vv8m-prf7

CentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669)

Published Sep 29, 2026 · Updated Sep 30, 2026 · Assigned by wikimedia-foundation

Vendor: Wikimedia Foundation Product: Mediawiki - CentralAuth Extension Category: Web / CMS

Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows Excavation.

This issue affects Mediawiki - CentralAuth Extension: from * before 1.46.1, 1.45.5, 1.43.10.

Affected products

VendorProductAffectedFixed
Wikimedia Foundation Mediawiki - CentralAuth Extension < 1.46.1, 1.45.5, 1.43.10 1.46.1, 1.45.5, 1.43.10

References