CVE-2026-58024: MediaWiki User Rights API Information Disclosure Vulnerability

Technical summary

CVE-2026-58024 is an information disclosure vulnerability in MediaWiki's ApiUserrights.php file, classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The vulnerability requires network access and low-complexity exploitation: an authenticated attacker must perform a UI-based action to trigger unauthorized data exposure. The CVSS 3.1 score of 5.7 (MEDIUM severity) reflects high confidentiality impact offset by the requirement for prior authentication and user interaction. The vulnerability affects all MediaWiki versions before 1.46.0, with patched versions also released for the 1.45, 1.44, and 1.43 maintenance branches.

Business impact

This vulnerability could expose sensitive information such as user account details, administrative metadata, or permission records depending on what ApiUserrights handles and returns. For wiki operators, this creates potential compliance violations (GDPR, privacy regulations), erosion of user trust, and operational risk if exposed data includes system administrator information or private user communications. The impact is contained to confidentiality—there is no data integrity or availability risk—but unauthorized exposure of user or administrative data warrants timely remediation, particularly for public-facing wikis.

Affected systems

MediaWiki versions prior to the following patched releases are affected: 1.46.0, 1.45.4, 1.44.6, and 1.43.9. If your instance runs any version before these thresholds in each branch, you are exposed. Self-hosted MediaWiki deployments are directly affected; vendors or organizations running managed MediaWiki services should verify their platform version with their provider.

Exploitability

Exploitation is feasible but not trivial. An attacker must already have valid credentials (registered user or higher), making this a post-authentication attack. The vulnerability requires user interaction—likely clicking a link or performing an action in the MediaWiki interface—which prevents fully automated exploitation. The attack surface is limited to the user rights API endpoint. Overall, exploitability is moderate: low technical complexity, but meaningful authentication and UI barriers reduce real-world exploitation risk compared to unauthenticated flaws.

Remediation

Update MediaWiki to one of the patched versions: 1.46.0 or later, 1.45.4 or later, 1.44.6 or later, or 1.43.9 or later. Operators of older branches (1.43 or prior) should prioritize upgrading to 1.43.9 as a minimum. If immediate patching is not feasible, review and restrict user rights API access via web server rules or extension controls to trusted internal networks only.

Patch guidance

Wikimedia Foundation has released security patches across four maintenance branches. Identify your running version via Special:Version in the MediaWiki admin panel. Match your version to the appropriate patch: if running 1.46.x, upgrade to 1.46.0+; 1.45.x, upgrade to 1.45.4+; 1.44.x, upgrade to 1.44.6+; 1.43.x, upgrade to 1.43.9+. Test the patch in a staging environment before production deployment to ensure compatibility with your extensions and custom code. Consult the Wikimedia security advisory for detailed upgrade instructions specific to your deployment method (Docker, source, package manager).

Detection guidance

Detect exploitation by monitoring ApiUserrights.php access logs for unusual query patterns—specifically, watch for authenticated sessions accessing user rights data that doesn't match the user's own account or expected administrative activity. Check for repeated or sequential API requests from single user accounts targeting user rights endpoints with different target users as parameters. Correlate with failed permission checks if your audit logging is enabled. A baseline of normal API usage is essential; anomalies may indicate reconnaissance or data harvesting.

Why prioritize this

This vulnerability merits prompt but not emergency remediation. The MEDIUM CVSS score and authentication barrier mean this is lower priority than critical unauthenticated RCE flaws, but the confidentiality impact and potential compliance implications (especially for European wikis under GDPR) justify scheduling the patch within your normal maintenance cycle. It is not on the KEV catalog, which further reduces active exploitation pressure. Prioritize above low-severity issues but below critical/high vulnerabilities affecting public-facing services without authentication.

Risk score, explained

The CVSS 3.1 score of 5.7 (MEDIUM) reflects a high-impact confidentiality breach (C:H) prevented from being scored higher by the requirement for authenticated access (PR:L) and user interaction (UI:R). Integrity and availability are unaffected (I:N, A:N). The attack vector is network-based (AV:N) and attack complexity is low (AC:L), meaning once a user is compromised or malicious, the attack is trivial to execute. For most organizations, this warrants expedited patching but does not trigger critical-incident response protocols.

Frequently asked questions