CVE-2026-58036: MediaWiki User Information Disclosure via Unauth API Access

Technical summary

CVE-2026-58036 is an information disclosure vulnerability (CWE-200) in MediaWiki's API layer, specifically affecting ApiQueryAllUsers.php, ApiQueryUsers.php, PermissionManager.php, and UserGroupManager.php. The vulnerability allows unauthenticated network attackers to enumerate users and retrieve sensitive attributes through API queries that lack proper authorization checks. The flaw exists in the permission validation logic, enabling information to be disclosed that should be gated behind authentication or role-based access controls.

Business impact

This vulnerability creates a data leakage risk for any organization running MediaWiki as a collaborative platform or knowledge base. Exposed user information could include usernames, email addresses, group memberships, and account metadata—information often exploited for targeted phishing, account enumeration attacks, or social engineering. For enterprises using MediaWiki internally, this represents a loss of user privacy and could facilitate subsequent attacks. Public wikis may face reputation damage if user data is harvested at scale.

Affected systems

All versions of MediaWiki that contain the vulnerable code paths in the user query and permission management modules are affected. Organizations should verify their specific MediaWiki version against the vendor advisory to determine applicability. This is a network-accessible component, meaning any MediaWiki instance exposed to the internet or accessible from a network containing potential adversaries is at risk.

Exploitability

This vulnerability has a high exploitability profile: it requires only network access, no authentication, no special user interaction, and no complex configuration. An attacker can craft API requests to enumerate users and extract sensitive information without leaving obvious traces in user actions. The CVSS 3.1 score of 7.5 reflects the high-confidence attack vector and complete confidentiality impact, though integrity and availability are not affected.

Remediation

Apply the security patch released by Wikimedia Foundation as soon as it becomes available. The patch will tighten authorization checks in the affected API endpoints and permission manager components. Until patching is possible, consider implementing network-level controls: restrict API endpoint access via firewall rules, disable the user query API if not required, or place MediaWiki behind authentication that validates all requests before they reach the application.

Patch guidance

Monitor Wikimedia Foundation's security advisory channels for the official patch version. Apply updates to a test environment first to verify compatibility with your configuration, extensions, and dependent systems. Once validated, schedule patching during a maintenance window. If you are running a version of MediaWiki that is no longer receiving updates, plan a version upgrade as part of your remediation strategy. Verify the patch application by confirming the vulnerability is no longer exploitable via the affected API endpoints.

Detection guidance

Monitor API logs for unusual patterns of calls to ApiQueryAllUsers.php and ApiQueryUsers.php, particularly from non-local IP addresses or without corresponding user session tokens. Look for rapid enumeration attempts (many distinct user lookups in short time windows) or requests from IP addresses that do not typically interact with your MediaWiki instance. Intrusion detection systems should alert on unexpected API traffic to these endpoints from external sources. Database access logs may also reveal unusual query patterns if attackers attempt to extract user information directly.

Why prioritize this

A CVSS 7.5 HIGH severity, network-accessible information disclosure without authentication requirements merits near-term action. While not immediately critical to operational continuity, the risk of user data leakage and the potential for this information to enable follow-on attacks (phishing, credential stuffing, social engineering) makes this a priority for any MediaWiki deployment, especially those containing user email addresses or sensitive group metadata. The lack of KEV designation suggests limited current weaponization, but that is not a reason to delay patching.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects: (1) Network-accessible attack vector with no authentication required (AV:N, PR:N), (2) Low attack complexity requiring only standard API calls (AC:L), (3) No user interaction needed (UI:N), (4) Complete confidentiality impact on user information (C:H), and (5) no impact to integrity or availability (I:N, A:N). This profile—easy exploitation, high information disclosure—justifies the HIGH severity classification.

Frequently asked questions