CVE-2026-34093
Special:UserRights allows viewing user rights from private wiki
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.
This vulnerability is associated with program files includes/Specials/SpecialUserRights.Php.
This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Active
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Special:UserRights allows viewing user rights from private wiki
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.
This vulnerability is associated with program files includes/Specials/SpecialUserRights.Php.
This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
- Record
CVE-2026-34093- CVSS 4.0
- 1.1 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/R:A - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2026-29107
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.
This vulnerability is associated with program files includes/Specials/SpecialUserRights.Php.
This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
- Record
EUVD-2026-29107- CVSS 4.0
- 1.1 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/R:A - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-34wc-vx7r-829j
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation...
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.
This vulnerability is associated with program files includes/Specials/SpecialUserRights.Php.
This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
- Record
GHSA-34wc-vx7r-829j- CVSS 4.0
- 1.1 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:A/V:X/RE:X/U:X - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
NVD
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.
This vulnerability is associated with program files includes/Specials/SpecialUserRights.Php.
This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
- Record
CVE-2026-34093- CVSS 4.0
- 1.1 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:A/V:X/RE:X/U:X - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.
This vulnerability is associated with program files includes/Specials/SpecialUserRights.Php.
This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
- Record
CVE-2026-34093- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-34093
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Specials/SpecialUserRights.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
- Record
DEBIAN-CVE-2026-34093- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-34093
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Specials/SpecialUserRights.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
- Record
UBUNTU-CVE-2026-34093- CVSS 4.0
- 1.1 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/R:A - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mediawikiDebian:12 |
before 1:1.39.17-1+deb12u2, plus listed versions 1:1.39.10-11:1.39.10-1~deb12u11:1.39.12-1~deb12u11:1.39.13-1~deb12u11:1.39.17-1~deb12u1 Show 10 moreShow less1:1.39.2-11:1.39.4-11:1.39.4-1~deb12u11:1.39.4-21:1.39.5-11:1.39.5-1~deb12u11:1.39.6-11:1.39.7-11:1.39.7-1~deb12u11:1.39.8-1 |
1:1.39.17-1+deb12u2 |
mediawikiDebian:13 |
before 1:1.43.8+dfsg-1~deb13u1, plus listed versions 1:1.43.3+dfsg-11:1.43.5+dfsg-11:1.43.6+dfsg-11:1.43.6+dfsg-1~deb13u11:1.43.6+dfsg-2 |
1:1.43.8+dfsg-1~deb13u1 |
mediawikiDebian:14 |
before 1:1.43.8+dfsg-1, plus listed versions 1:1.43.3+dfsg-11:1.43.5+dfsg-11:1.43.6+dfsg-11:1.43.6+dfsg-1~deb13u11:1.43.6+dfsg-21:1.43.8+dfsg-1~deb13u1 |
1:1.43.8+dfsg-1 |
mediawikiUbuntu:18.04:LTS |
All versions, plus listed versions 1:1.27.3-11:1.27.4-11:1.27.4-21:1.27.4-3 |
None known |
mediawikiUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1:1.31.2-1ubuntu11:1.31.5-11:1.31.5-1ubuntu11:1.31.5-21:1.31.5-3 Show 4 moreShow less1:1.31.5-3ubuntu11:1.31.6-11:1.31.7-11:1.31.7-1ubuntu0.1~esm1 |
None known |
mediawikiUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1:1.35.3-11:1.35.4-11:1.35.5-11:1.35.5-1ubuntu11:1.35.5-1ubuntu21:1.35.5-1ubuntu31:1.35.6-11:1.35.6-1ubuntu0.1~esm1 |
None known |
mediawikiUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 1:1.39.4-21:1.39.5-11:1.39.6-11:1.39.7-11:1.39.7-1ubuntu0.1~esm1 |
None known |
mediawikiUbuntu:25.10 |
All versions, plus listed versions 1:1.43.1+dfsg-11:1.43.1+dfsg-21:1.43.3+dfsg-1 |
None known |
mediawikiUbuntu:26.10 |
All versions, plus listed versions 1:1.43.8+dfsg-21:1.43.9+dfsg-11:1.43.9+dfsg-1ubuntu1 |
None known |
mediawikiUbuntu:26.04:LTS |
All versions, plus listed versions 1:1.43.3+dfsg-11:1.43.5+dfsg-11:1.43.6+dfsg-21:1.43.8+dfsg-11:1.43.8+dfsg-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-34093 is a low vulnerability (CVSS 1.1) in Mediawiki, published May 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 13th percentile. Fixed in mediawiki 1:1.39.17-1+deb12u2.
References
phabricator.wikimedia.org/T414547
nvd.nist.gov/vuln/detail/CVE-2026-34093
github.com/advisories/GHSA-34wc-vx7r-829j
security-tracker.debian.org/tracker/CVE-2026-34093
ubuntu.com/security/CVE-2026-34093
cve.org/CVERecord?id=CVE-2026-34093
gerrit.wikimedia.org/r/c/mediawiki/core/+/1265667
lists.wikimedia.org/hyperkitty/list/[email protected]/thread/DIBLSBHISKX6NFRUFNOGZRVW42E7R2QP