CVE-2026-58034: CheckUser Cross-Site Scripting (XSS) Vulnerability in MediaWiki

Technical summary

CVE-2026-58034 is an improper input neutralization vulnerability (CWE-79) in the blockConnectedTempAccountsField.Vue component of CheckUser versions 1.46.0-rc.0 through versions prior to 1.46.0. The vulnerability allows stored or reflected XSS attacks when user-supplied data is rendered without adequate sanitization. The attack requires administrative privileges and user interaction (the victim must view the malicious payload), but executes in a cross-site context, potentially affecting multiple users and administrative workflows.

Business impact

Organizations running MediaWiki with the CheckUser extension face risk of administrative account compromise and unauthorized access to CheckUser logs, which contain sensitive information about user accounts and IP addresses. A compromised administrator session could enable account manipulation, vandalism coordination detection evasion, or data exfiltration. The impact is scoped to users with access to CheckUser's administrative interface, limiting blast radius but not eliminating operational risk.

Affected systems

MediaWiki installations with the CheckUser extension versions 1.46.0-rc.0 before 1.46.0 are affected. CheckUser is a specialized extension used by wiki administrators for detecting and investigating sockpuppet accounts and coordinated editing. Deployment is typically limited to large collaborative wiki platforms and internal MediaWiki instances, not general end-user systems.

Exploitability

Exploitation requires administrative credentials and relies on social engineering or phishing to trick an administrator into triggering the malicious payload. The attack does not require network-level access and can be delivered via wiki page edits or form inputs. However, the combination of high privilege requirement and user interaction needed reduces opportunistic exploitation risk. The vulnerability is not listed on the CISA KEV catalog, indicating no known active exploitation campaigns at publication.

Remediation

Upgrade CheckUser to version 1.46.0 or later. Organizations unable to upgrade immediately should restrict CheckUser extension access to trusted administrators, review access logs for suspicious activity, and monitor for XSS-related alerts in user authentication logs. Implement content security policies (CSP) at the MediaWiki level to further constrain script execution.

Patch guidance

Apply CheckUser version 1.46.0 or verify against the Wikimedia Foundation's official security advisory and release notes for confirmation of XSS remediation. Test the patch in a staging environment before production deployment to ensure compatibility with custom extensions or local MediaWiki configurations. The final release (1.46.0, not rc.0) includes the fix.

Detection guidance

Monitor web server logs and WAF records for suspicious input patterns in CheckUser administrative forms, particularly the blockConnectedTempAccountsField parameter. Search MediaWiki revision history and logs for unexpected JavaScript or HTML tags in CheckUser-related edits. Review browser console errors and Content Security Policy violation reports. Audit administrator session logs for activity following times when CheckUser pages were accessed.

Why prioritize this

Assign medium priority. While the CVSS score is 4.8 (medium) and active exploitation is not documented, the attack targets privileged administrator roles with access to sensitive sockpuppet detection data. Organizations relying on CheckUser for abuse prevention should patch promptly; others can include this in standard maintenance windows. The prerequisite of high privileges and user interaction limits urgency relative to remote, unauthenticated flaws.

Risk score, explained

The CVSS 3.1 score of 4.8 reflects: network-accessible attack vector (AV:N), low attack complexity (AC:L), requirement for high privilege (PR:H), and user interaction (UI:R). The impact is confidentiality and integrity (C:L, I:L) with no availability impact (A:N). Scope changes (S:C), broadening exposure beyond the vulnerable component, but the high privilege gate and user interaction requirement keep severity in the medium band rather than high.

Frequently asked questions