{"id":"CVE-2026-34087","aliases":["DEBIAN-CVE-2026-34087","EUVD-2026-29059","GHSA-6fcc-jw5f-pvm9","UBUNTU-CVE-2026-34087","USN-8315-1"],"status":"published","title":"Users API leaks whether privileged users have their user groups disabled for lack of 2FA","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth.\n\nThis issue affects OATHAuth: from * before 1.43.7, 1.44.4, 1.45.2.","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/S:N/AU:Y/R:A/RE:M","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00267,"percentile":0.18984,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2026-05-11T14:40:12Z","modified":"2026-10-28T02:30:35Z","fixes":[{"ecosystem":"Debian:12","package":"mediawiki","fixed_in":["1:1.39.17-1+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mediawiki","fixed_in":["1:1.43.8+dfsg-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mediawiki","fixed_in":["1:1.43.8+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"mediawiki","fixed_in":["1:1.35.6-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"mediawiki","fixed_in":["1:1.39.7-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"mediawiki","fixed_in":["1:1.43.8+dfsg-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"mediawiki","fixed_in":["1:1.43.8+dfsg-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.39.17-1+deb12u2"}]}],"versions":["1:1.39.10-1","1:1.39.10-1~deb12u1","1:1.39.12-1~deb12u1","1:1.39.13-1~deb12u1","1:1.39.17-1~deb12u1","1:1.39.2-1","1:1.39.4-1","1:1.39.4-1~deb12u1","1:1.39.4-2","1:1.39.5-1","1:1.39.5-1~deb12u1","1:1.39.6-1","1:1.39.7-1","1:1.39.7-1~deb12u1","1:1.39.8-1"]},{"source":"osv","ecosystem":"Debian:13","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.43.8+dfsg-1~deb13u1"}]}],"versions":["1:1.43.3+dfsg-1","1:1.43.5+dfsg-1","1:1.43.6+dfsg-1","1:1.43.6+dfsg-1~deb13u1","1:1.43.6+dfsg-2"]},{"source":"osv","ecosystem":"Debian:14","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.43.8+dfsg-1"}]}],"versions":["1:1.43.3+dfsg-1","1:1.43.5+dfsg-1","1:1.43.6+dfsg-1","1:1.43.6+dfsg-1~deb13u1","1:1.43.6+dfsg-2","1:1.43.8+dfsg-1~deb13u1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.6-1ubuntu0.1~esm1"}]}],"versions":["1:1.35.3-1","1:1.35.4-1","1:1.35.5-1","1:1.35.5-1ubuntu1","1:1.35.5-1ubuntu2","1:1.35.5-1ubuntu3","1:1.35.6-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.39.7-1ubuntu0.1~esm1"}]}],"versions":["1:1.39.4-2","1:1.39.5-1","1:1.39.6-1","1:1.39.7-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.43.1+dfsg-1","1:1.43.1+dfsg-2","1:1.43.3+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.43.8+dfsg-2"}]}]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.43.8+dfsg-2"}]}],"versions":["1:1.43.3+dfsg-1","1:1.43.5+dfsg-1","1:1.43.6+dfsg-2","1:1.43.8+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.31.7-1ubuntu0.1~esm1"}]}],"versions":["1:1.31.2-1ubuntu1","1:1.31.5-1","1:1.31.5-1ubuntu1","1:1.31.5-2","1:1.31.5-3","1:1.31.5-3ubuntu1","1:1.31.6-1","1:1.31.7-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.6-1ubuntu0.1~esm1"}]}],"versions":["1:1.35.3-1","1:1.35.4-1","1:1.35.5-1","1:1.35.5-1ubuntu1","1:1.35.5-1ubuntu2","1:1.35.5-1ubuntu3","1:1.35.6-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.39.7-1ubuntu0.1~esm1"}]}],"versions":["1:1.39.4-2","1:1.39.5-1","1:1.39.6-1","1:1.39.7-1"],"bundled":3}],"products":[{"vendor":"mediawiki","product":"mediawiki"},{"vendor":"wikimedia foundation","product":"oathauth"}],"references":[{"url":"https://phabricator.wikimedia.org/T412061","tags":["Issue Tracking","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34087"},{"url":"https://github.com/advisories/GHSA-6fcc-jw5f-pvm9"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-34087","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-34087","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34087","tags":["report"]},{"url":"https://gerrit.wikimedia.org/r/c/mediawiki/extensions/OATHAuth/+/1265614","tags":["report"]},{"url":"https://gerrit.wikimedia.org/r/c/mediawiki/extensions/OATHAuth/+/1265610","tags":["report"]},{"url":"https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/DIBLSBHISKX6NFRUFNOGZRVW42E7R2QP/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8315-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-34088","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-34092","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-34087","title":"Users API leaks whether privileged users have their user groups disabled for lack of 2FA","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth.\n\nThis issue affects OATHAuth: from * before 1.43.7, 1.44.4, 1.45.2.","status":"published","published":"2026-05-11T14:40:12.778Z","modified":"2026-05-11T16:03:51.63Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/S:N/AU:Y/R:A/RE:M","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:20:13.962274Z"}],"euvd":[{"id":"EUVD-2026-29059","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth.\n\nThis issue affects OATHAuth: from * before 1.43.7, 1.44.4, 1.45.2.","status":"published","published":"2026-05-11T14:40:12Z","modified":"2026-05-11T16:03:51Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/S:N/AU:Y/R:A/RE:M","level":"medium"}],"updated_at":"2026-11-02T19:05:10.736891Z"}],"ghsa":[{"id":"GHSA-6fcc-jw5f-pvm9","title":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation...","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth.\n\nThis issue affects OATHAuth: from * before 1.43.7, 1.44.4, 1.45.2.","status":"published","published":"2026-05-11T18:31:43Z","modified":"2026-05-14T18:33:53Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:X/RE:M/U:X","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:08:08.953643Z"}],"nvd":[{"id":"CVE-2026-34087","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth.\n\nThis issue affects OATHAuth: from * before 1.43.7, 1.44.4, 1.45.2.","status":"published","published":"2026-05-11T16:17:30.023Z","modified":"2026-10-26T18:10:00.173Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:X/RE:M/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:18.239974Z"}],"osv":[{"id":"CVE-2026-34087","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth.\n\nThis issue affects OATHAuth: from * before 1.43.7, 1.44.4, 1.45.2.","status":"published","published":"2026-05-11T16:17:30.023Z","modified":"2026-10-28T02:30:35.669330916Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:02.247031Z"},{"id":"DEBIAN-CVE-2026-34087","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth.  This issue affects OATHAuth: from * before 1.43.7, 1.44.4, 1.45.2.","status":"published","published":"2026-05-11T16:17:30.023Z","modified":"2026-10-27T09:47:43.388940683Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"UBUNTU-CVE-2026-34087","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth. This issue affects OATHAuth: from * before 1.43.7, 1.44.4, 1.45.2.","status":"published","published":"2026-05-11T16:17:00Z","modified":"2026-10-17T13:00:00.740703794Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/S:N/AU:Y/R:A/RE:M","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"USN-8315-1","title":"mediawiki vulnerabilities","description":"It was discovered that MediaWiki incorrectly handled group membership \nvisibility in the OATHAuth extension. An authenticated attacker could \nuse this issue to determine if other users had two-factor authentication \nenabled. (CVE-2026-34087)\n\nIt was discovered that MediaWiki incorrectly handled suppressed log entry \ntitles in the RecentChanges list. An unauthenticated attacker could use \nthis issue to view titles of deleted or suppressed pages that should be hidden.\n(CVE-2026-34088)\n\nIt was discovered that MediaWiki incorrectly handled resource loading timing\ninformation. An attacker could use this issue to determine if certain pages \nexisted on a wiki. (CVE-2026-34092)","status":"published","published":"2026-05-27T08:39:27Z","modified":"2026-05-27T15:47:45.721301211Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}