CVE-2026-58027: Wikimedia AbuseFilter Information Disclosure Vulnerability

Technical summary

CVE-2026-58027 is an information disclosure vulnerability (CWE-200) in Wikimedia's AbuseFilter extension. The flaw exists in the QueryAbuseFilters API endpoint and allows authenticated actors to retrieve sensitive data due to insufficient access controls. The vulnerability requires network access and authentication but no user interaction. CVSS 3.1 score is 6.5 (MEDIUM) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating high confidentiality impact confined to the affected component's scope.

Business impact

Organizations operating MediaWiki instances with AbuseFilter enabled may expose sensitive moderation and filter configuration details to authenticated users who lack proper authorization. This could compromise the integrity of spam and abuse detection strategies, reveal internal policy logic, or expose metadata about site moderation that could be weaponized by bad actors with legitimate wiki accounts. The impact depends on deployment context—public wikis with open registration face higher risk than private knowledge bases.

Affected systems

The vulnerability affects Wikimedia Foundation AbuseFilter in versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9. All releases prior to these patch versions are vulnerable. The issue is associated with the includes/Api/QueryAbuseFilters.Php program file. AbuseFilter integrates with MediaWiki, so any MediaWiki instance using AbuseFilter from an affected version line is in scope.

Exploitability

Exploitability is moderate. An attacker must already possess valid authentication credentials to the MediaWiki instance—this eliminates unauthenticated attack vectors. No special privileges are required; a regular authenticated user can trigger the information disclosure. The attack is straightforward once authenticated and requires no user interaction or complex conditions. However, the requirement for authentication substantially reduces the attack surface compared to unauthenticated vulnerabilities.

Remediation

Update AbuseFilter to a patched version immediately: 1.46.0 or later, 1.45.4 or later, 1.44.6 or later, or 1.43.9 or later, depending on your current release line. The patches implement proper authorization checks on the QueryAbuseFilters API endpoint to prevent information disclosure to unauthorized actors. Verify the patch version against the official Wikimedia Foundation advisory before deployment.

Patch guidance

1. Identify your current AbuseFilter version via Special:Version on your MediaWiki instance. 2. Determine which release line you operate: 1.46.x, 1.45.x, 1.44.x, or 1.43.x. 3. Update to the minimum patched version for that line: 1.46.0+, 1.45.4+, 1.44.6+, or 1.43.9+. 4. Test the patch in a staging environment, particularly the AbuseFilter API endpoints, to confirm no disruption to legitimate moderation workflows. 5. Roll out to production during a maintenance window to minimize user impact. 6. Post-deployment, verify via Special:Version and audit API access logs for any anomalous QueryAbuseFilters requests from before the patch date.

Detection guidance

Monitor access logs for queries to Special:AbuseFilter/query or API calls to action=query&list=abusefilters, particularly from low-privilege user accounts. Look for repeated or unusual attempts to enumerate or retrieve filter details. If you can access MediaWiki debug logs, check for CWE-200 or authorization bypass patterns in the QueryAbuseFilters endpoint. A security review of recent API access—especially between the vulnerability publish date (2026-07-01) and your patching date—can identify whether the flaw was exploited in your instance.

Why prioritize this

Medium CVSS (6.5) warrants prompt but not emergency response. The confidentiality impact is high, but authentication is required and there is no integrity or availability impact. Prioritize if: your wiki permits untrusted user registrations; your AbuseFilter rules contain sensitive policy or blacklist logic; you operate a public-facing MediaWiki; or your instance houses proprietary knowledge. Deprioritize if your wiki is private and only trusted users can register. The lack of CISA KEV listing suggests no active in-the-wild exploitation as of publication, reducing urgency relative to critical flaws.

Risk score, explained

The CVSS score of 6.5 reflects the combination of network-accessible attack vector, low attack complexity, and high confidentiality impact, offset by the requirement for authenticated access and absence of integrity or availability consequences. The score appropriately places this in the Medium band—serious enough to patch promptly but not an emergency comparable to remote code execution or privilege escalation flaws. Organizations should treat this as a high-priority maintenance item rather than an emergency.

Frequently asked questions