CVE-2026-58026: MediaWiki Sensitive Information Disclosure in Parser (CVSS 5.7)

Technical summary

CVE-2026-58026 is an information disclosure vulnerability (CWE-200) in MediaWiki's Parser.php file that permits authenticated users to access confidential data beyond their authorization scope. The vulnerability requires both valid credentials and user interaction to trigger, as indicated by the CVSS vector components (PR:L for low privilege requirement, UI:R for user interaction required). The confidentiality impact is rated high (C:H), while integrity and availability remain unaffected (I:N, A:N). The attack vector is network-based with low complexity, suggesting straightforward exploitation once an attacker gains initial access.

Business impact

The exposure of sensitive information through this parser vulnerability creates compliance and competitive risk for organizations running MediaWiki. Depending on the content stored—documentation, proprietary workflows, or internal communications—unauthorized disclosure could violate data protection regulations, damage competitive advantage, or erode stakeholder trust. The requirement for authenticated access somewhat limits the threat scope to insider threats and compromised accounts, but organizations with permissive user provisioning or shared accounts face elevated exposure. Reputational damage from information leakage during a security incident can be substantial, particularly for knowledge-based or collaborative platforms.

Affected systems

MediaWiki versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9 are vulnerable. This affects organizations running any unsupported or unpatched version across these release branches. Both standalone MediaWiki deployments and those integrated into larger wikis or documentation systems are in scope. The vulnerability's age and breadth of affected versions means many legacy or long-term supported installations remain at risk if update schedules have been deferred.

Exploitability

Exploitation requires a valid MediaWiki user account and active user interaction to trigger the parser flaw. This is a meaningful operational barrier that prevents opportunistic attacks from fully unauthenticated threat actors. However, the attack complexity is low once authentication is obtained, meaning any user with legitimate access can reliably exploit the vulnerability with minimal technical skill. Organizations with single sign-on, shared accounts, or a large internal user base face higher practical risk than those with strict access controls and identity governance.

Remediation

Apply security patches to bring MediaWiki to a patched version: 1.46.0 or later, 1.45.4 or later, 1.44.6 or later, or 1.43.9 or later, depending on your deployment's supported branch. Verify patch availability in the Wikimedia Foundation security advisory for your specific version track. Administrators should prioritize instances containing highly sensitive documentation or internal communications. Test patches in a staging environment before production rollout to ensure compatibility with extensions and custom configurations.

Patch guidance

Review your current MediaWiki version and identify which supported branch you follow (1.46, 1.45, 1.44, or 1.43). Obtain the corresponding patched release from the Wikimedia Foundation's official download or distribution channel. For extended support versions, ensure patches are available from your support vendor. Schedule patching during a maintenance window, coordinate with users if the wiki will be briefly offline, and validate that extensions and custom parser hooks remain functional post-patch. Organizations on very old versions not explicitly listed (e.g., 1.42 or earlier) should evaluate end-of-life status and plan migration accordingly.

Detection guidance

Monitor server logs and access patterns for authenticated users accessing parser functions or page previews that include sensitive content they should not view. Look for unusual access to pages containing private information, templates, or metadata by low-privilege accounts. Examine Parser.php error logs for exceptions or unusual parser state during the vulnerability window before patching. Implement audit logging on page access and modification if available. Note that detection is challenging post-exploitation; focus on identifying unauthorized access patterns during the incident response phase. Intrusion detection systems may have limited visibility since the attack is internal to the application logic.

Why prioritize this

This vulnerability merits prompt attention due to the combination of authenticated-only access (which narrows scope but doesn't eliminate risk in permissive environments) and high confidentiality impact. Organizations with sensitive internal documentation, proprietary knowledge bases, or regulatory data stored in MediaWiki should prioritize patching. The CVSS score of 5.7 (MEDIUM) reflects the authentication barrier, but the real-world severity depends heavily on deployment context. The absence of active exploitation in the wild (KEV not listed) provides a window for orderly patching without emergency pressure, but the broad range of affected versions means many installations are still vulnerable.

Risk score, explained

The CVSS 5.7 MEDIUM score balances a high confidentiality impact against the requirements for valid authentication and user interaction. The network attack vector and low attack complexity keep severity from being lower, but the privilege and interaction requirements prevent a HIGH rating. Organizations with large user populations, especially those not segregating information access by role, should mentally elevate this within their own prioritization framework. The absence from the CISA KEV catalog indicates no current active exploitation, reducing urgency relative to critical vulnerabilities, but does not diminish the underlying information disclosure risk.

Frequently asked questions