CVE-2026-58033: MediaWiki Information Disclosure Vulnerability – Patch Now

Technical summary

CVE-2026-58033 is an information disclosure vulnerability (CWE-200) in MediaWiki's InfoAction.php file. The flaw allows unauthenticated attackers to access sensitive information through a network vector with low attack complexity and no privilege requirements. Exploitation requires user interaction (UI:R), suggesting the attack relies on social engineering or malicious link delivery. The vulnerability affects multiple supported versions of MediaWiki across the 1.43, 1.44, 1.45, and 1.46 release lines, with patched versions available at 1.43.9, 1.44.6, 1.45.4, and 1.46.0 or later.

Business impact

For organizations running public or internally-hosted MediaWiki instances, this vulnerability poses a moderate risk to data confidentiality. Attackers can craft social engineering campaigns to trick users into clicking malicious links, potentially exposing wiki content, user metadata, or other sensitive information. The lack of an active exploitation detection (not on KEV list as of publication) suggests exploitation may be limited in the wild, but the attack surface remains broad given MediaWiki's prevalence in enterprise knowledge management and open-source collaboration platforms.

Affected systems

All versions of MediaWiki prior to 1.46.0 are affected, including legacy branches: 1.43.x (before 1.43.9), 1.44.x (before 1.44.6), 1.45.x (before 1.45.4), and any earlier 1.x version not receiving security updates. MediaWiki deployments on any of these versions should be considered at risk if they expose the InfoAction component to untrusted users.

Exploitability

Exploitation requires network access and user interaction, reducing the attack surface significantly compared to unauthenticated remote code execution flaws. An attacker must craft a URI or embed a link in a message, forum post, or email that causes a target user to visit a specially crafted MediaWiki information page. Once the user follows the link, the sensitive data exposure occurs without additional user awareness or consent. The CVSS score of 6.5 reflects this moderate risk: high impact on confidentiality but mitigated by interaction and network-only scope.

Remediation

Upgrade MediaWiki to a patched version immediately. Version selection depends on your current deployment: upgrade to 1.43.9 or later for the 1.43 series, 1.44.6 or later for 1.44, 1.45.4 or later for 1.45, or 1.46.0 or later for 1.46 and beyond. Test patches in a non-production environment before rollout to ensure compatibility with installed extensions and customizations. If immediate patching is not feasible, implement access controls to restrict who can trigger InfoAction queries and monitor for unusual information disclosure patterns in access logs.

Patch guidance

Wikimedia Foundation has released security updates for all affected branches. Determine your current MediaWiki version and apply the minimum patched version for your branch: 1.43.9, 1.44.6, 1.45.4, or 1.46.0+. Patches should be available via the official MediaWiki security download page or your package manager. After patching, clear any browser caches and verify that the InfoAction component functions correctly for legitimate use cases. Review any extensions that hook into InfoAction to ensure they do not reintroduce the vulnerability.

Detection guidance

Monitor web server logs for suspicious or repeated requests to pages or actions matching the InfoAction pattern (typically URLs containing 'action=info' or similar). Unusual referrer patterns, requests from external domains, or click-through rates on InfoAction links from unexpected sources may indicate exploitation attempts. Implement Web Application Firewall (WAF) rules to flag or rate-limit repeated or malformed requests to the InfoAction component. Review MediaWiki debug logs for any CacheKey or permission-related warnings that may correlate with the vulnerability trigger.

Why prioritize this

Although the CVSS score is moderate (6.5) and the vulnerability is not yet actively exploited in the wild (not on KEV), the attack surface is broad and the fix is straightforward. Organizations using MediaWiki should prioritize this patch in their regular security update cycle, aiming for deployment within 30 days of release. Given the low attack complexity and the ubiquity of MediaWiki in knowledge management, early patching reduces opportunistic exploitation risk.

Risk score, explained

The CVSS v3.1 score of 6.5 (MEDIUM) reflects high confidentiality impact (C:H) with no impact on integrity or availability. The network vector and lack of privilege requirements lower the barrier to entry. However, the requirement for user interaction (UI:R) prevents this from being a critical worm vector. Organizations with high-sensitivity wiki content or strict data-handling policies may rate this internally as HIGH and prioritize more aggressively.

Frequently asked questions