CVE-2026-103442

External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43...

CVE-2026-103442

The MediaWiki CentralAuth extension versions 1.46, 1.45, and 1.43 are vulnerable to a Code Injection flaw due to an external control of system or configuration settings. While the description mentions a MergeAccount PHP object injection via session-key substitution in related records, the primary...

CVE-2026-103442 MergeAccount PHP object injection via session-key substitution

External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43...

CVE-2026-100244

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows Excavation. This issue affects Mediawiki - CentralAuth Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-100244 CentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669)

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows Excavation. This issue affects Mediawiki - CentralAuth Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-100244

The Wikimedia Foundation Mediawiki - CentralAuth Extension is vulnerable to an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. The flaw allows for the exposure of locally suppressed block information via the globaluserinfo API and Special:CentralAuth . This issue is char...

EUVD-2026-89090

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows Excavation. This issue affects Mediawiki - CentralAuth Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-100244 CentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669)

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows Excavation. This issue affects Mediawiki - CentralAuth Extension: from before 1.46.1, 1.45.5, 1.43.10...

EUVD-2026-19984

Improper removal of sensitive information before storage or transfer vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resource Leak Exposure.This issue affects non release branches...

CVE-2026-39937 Global vanishing does not completely remove user email

Improper removal of sensitive information before storage or transfer vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resource Leak Exposure. The issue has been remediated on the master branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1....

CVE-2026-39937

CVE-2026-39937 concerns the Wikimedia Foundation’s MediaWiki CentralAuth Extension. The issue is an improper removal of sensitive information before storage or transfer, resulting in a Resource Leak Exposure. According to the connected documents, the vulnerability has been remediated on the maste...

CVE-2026-39937: Improper Removal of Sensitive Information Before Storage or Transfer

Improper removal of sensitive information before storage or transfer vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resource Leak Exposure. The issue has been remediated on the master branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1....

MediaWiki - CentralAuth Extension 安全漏洞

MediaWiki - CentralAuth Extension is an authentication plugin developed under open source by MediaWiki. The MediaWiki - CentralAuth Extension has a security vulnerability; this vulnerability arises from the improper removal of sensitive information during storage or transmission, which may lead t...

Mediawiki - CentralAuth Extension Resource Disclosure Vulnerability

Mediawiki - CentralAuth Extension is an extension to MediaWiki designed for the Wikimedia project to manage cross-site user account merging, locking, renaming and other operations. A resource disclosure vulnerability exists in Mediawiki - CentralAuth Extension, which stems from the exposure of...

CVE-2025-62669

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resource Leak Exposure.This issue affects Mediawiki - CentralAuth Extension: from master before 1.39...

CVE-2025-62669 UserInfoCard: activeLocalBlocksAllWikis does not do permissions checks

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resource Leak Exposure.This issue affects Mediawiki - CentralAuth Extension: from master before 1.39...

CVE-2025-62669

The CVE-2025-62669 entry concerns Wikimedia’s MediaWiki CentralAuth Extension, describing a resource disclosure vulnerability that exposes sensitive information. Multiple sources (NVD entry, Red Hat, EU ENISA, CNVD, CVE/CVEList, and vuln enrichment) align on: affected component is CentralAuth Ext...

PT-2025-42684

Name of the Vulnerable Software and Affected Versions Wikimedia Foundation Mediawiki - CentralAuth Extension versions prior to 1.39 Description A resource leak exposure exists in the Wikimedia Foundation Mediawiki - CentralAuth Extension. This allows for the potential exposure of sensitive...

Mediawiki - CentralAuth Extension 安全漏洞

Mediawiki - CentralAuth Extension is an extension to MediaWiki designed for the Wikimedia project to manage cross-site user account merging, locking, renaming and other operations. A resource disclosure vulnerability exists in Mediawiki - CentralAuth Extension, which stems from the exposure of...

CVE-2025-62669: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resource Leak Exposure.This issue affects Mediawiki - CentralAuth Extension: from master before 1.39...