CVE-2026-100244 CentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669)

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows Excavation. This issue affects Mediawiki - CentralAuth Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-100244

The Wikimedia Foundation Mediawiki - CentralAuth Extension is vulnerable to an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. The flaw allows for the exposure of locally suppressed block information via the globaluserinfo API and Special:CentralAuth . This issue is char...

CVE-2026-100244 CentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669)

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows Excavation. This issue affects Mediawiki - CentralAuth Extension: from before 1.46.1, 1.45.5, 1.43.10...

Cross site request forgery (csrf)

The CentralAuth extension through REL134 for MediaWiki allows remote attackers to obtain sensitive hidden account information via an api.php?action=query&meta=globaluserinfo&guiuser= request. In other words, the information can be retrieved via the action API even though access would be denied wh...

CVE-2020-12051

The CentralAuth extension through REL134 for MediaWiki allows remote attackers to obtain sensitive hidden account information via an api.php?action=query&meta=globaluserinfo&guiuser= request. In other words, the information can be retrieved via the action API even though access would be denied wh...

PT-2020-13016

Name of the Vulnerable Software and Affected Versions MediaWiki CentralAuth extension versions through REL1 34 Description The issue allows remote attackers to obtain sensitive hidden account information. This can be done via the "api.php?action=query&meta=globaluserinfo&guiuser=" request, which ...