None · 0.0 CVE-2026-58034 EUVD-2026-41011GHSA-5m8f-rxqc-4gpj

Stored XSS through a system message when blocking a temporary account that's related to other temporary accounts

Published Jul 1, 2026 · Updated Jul 1, 2026 · Assigned by wikimedia-foundation

Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser.

This vulnerability is associated with program files modules/ext.CheckUser.TempAccounts/components/blockConnectedTempAccountsField.Vue.

This issue affects CheckUser: from 1.46.0-rc.0 before 1.46.0.

Vendor	Product	Affected	Fixed
Wikimedia Foundation	CheckUser	1.46.0-rc.0 – < 1.46.0	1.46.0