Medium · 6.9 CVE-2026-96879 EUVD-2026-87323GHSA-xxh4-xg3q-g2r6

"Checked by" label in page history should not be shown if the underlying review log entry is suppressed"

Published Sep 25, 2026 · Updated Sep 29, 2026 · Assigned by wikimedia-foundation

Vendor: The Wikimedia Foundation Product: Mediawiki - FlaggedRevs extension Category: Web / CMS

Description

Improper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation's Mediawiki - FlaggedRevs extension through 1.46.0.

Affected products

Vendor	Product	Affected	Fixed
The Wikimedia Foundation	Mediawiki - FlaggedRevs extension	≤ 1.46.0	—

Advisories 1

WID-SEC-2026-3597 MediaWiki Extensions: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 27, 2026

References

https://phabricator.wikimedia.org/T433020
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/FlaggedRevs/+/1344737