{"id":"CVE-2026-34088","aliases":["DEBIAN-CVE-2026-34088","EUVD-2026-29060","GHSA-wpmg-m9mx-w7pj","UBUNTU-CVE-2026-34088","USN-8315-1"],"status":"published","title":"RecentChanges entries expose suppressed content via generated log page html","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.\n\nThis issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.","severity":{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/R:U/RE:M","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0029,"percentile":0.2181,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2026-05-11T14:43:44Z","modified":"2026-10-28T02:31:01Z","fixes":[{"ecosystem":"Debian:12","package":"mediawiki","fixed_in":["1:1.39.17-1+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mediawiki","fixed_in":["1:1.43.8+dfsg-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mediawiki","fixed_in":["1:1.43.8+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"mediawiki","fixed_in":["1:1.31.7-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"mediawiki","fixed_in":["1:1.35.6-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"mediawiki","fixed_in":["1:1.39.7-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"mediawiki","fixed_in":["1:1.43.8+dfsg-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"mediawiki","fixed_in":["1:1.43.8+dfsg-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.39.17-1+deb12u2"}]}],"versions":["1:1.39.10-1","1:1.39.10-1~deb12u1","1:1.39.12-1~deb12u1","1:1.39.13-1~deb12u1","1:1.39.17-1~deb12u1","1:1.39.2-1","1:1.39.4-1","1:1.39.4-1~deb12u1","1:1.39.4-2","1:1.39.5-1","1:1.39.5-1~deb12u1","1:1.39.6-1","1:1.39.7-1","1:1.39.7-1~deb12u1","1:1.39.8-1"]},{"source":"osv","ecosystem":"Debian:13","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.43.8+dfsg-1~deb13u1"}]}],"versions":["1:1.43.3+dfsg-1","1:1.43.5+dfsg-1","1:1.43.6+dfsg-1","1:1.43.6+dfsg-1~deb13u1","1:1.43.6+dfsg-2"]},{"source":"osv","ecosystem":"Debian:14","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.43.8+dfsg-1"}]}],"versions":["1:1.43.3+dfsg-1","1:1.43.5+dfsg-1","1:1.43.6+dfsg-1","1:1.43.6+dfsg-1~deb13u1","1:1.43.6+dfsg-2","1:1.43.8+dfsg-1~deb13u1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.31.7-1ubuntu0.1~esm1"}]}],"versions":["1:1.31.2-1ubuntu1","1:1.31.5-1","1:1.31.5-1ubuntu1","1:1.31.5-2","1:1.31.5-3","1:1.31.5-3ubuntu1","1:1.31.6-1","1:1.31.7-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.6-1ubuntu0.1~esm1"}]}],"versions":["1:1.35.3-1","1:1.35.4-1","1:1.35.5-1","1:1.35.5-1ubuntu1","1:1.35.5-1ubuntu2","1:1.35.5-1ubuntu3","1:1.35.6-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.39.7-1ubuntu0.1~esm1"}]}],"versions":["1:1.39.4-2","1:1.39.5-1","1:1.39.6-1","1:1.39.7-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.43.1+dfsg-1","1:1.43.1+dfsg-2","1:1.43.3+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.43.8+dfsg-2"}]}]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.43.8+dfsg-2"}]}],"versions":["1:1.43.3+dfsg-1","1:1.43.5+dfsg-1","1:1.43.6+dfsg-2","1:1.43.8+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.31.7-1ubuntu0.1~esm1"}]}],"versions":["1:1.31.2-1ubuntu1","1:1.31.5-1","1:1.31.5-1ubuntu1","1:1.31.5-2","1:1.31.5-3","1:1.31.5-3ubuntu1","1:1.31.6-1","1:1.31.7-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.6-1ubuntu0.1~esm1"}]}],"versions":["1:1.35.3-1","1:1.35.4-1","1:1.35.5-1","1:1.35.5-1ubuntu1","1:1.35.5-1ubuntu2","1:1.35.5-1ubuntu3","1:1.35.6-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.39.7-1ubuntu0.1~esm1"}]}],"versions":["1:1.39.4-2","1:1.39.5-1","1:1.39.6-1","1:1.39.7-1"],"bundled":3}],"products":[{"vendor":"mediawiki","product":"mediawiki"},{"vendor":"wikimedia foundation","product":"mediawiki"}],"references":[{"url":"https://phabricator.wikimedia.org/T410429","tags":["Issue Tracking","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34088"},{"url":"https://github.com/advisories/GHSA-wpmg-m9mx-w7pj"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-34088","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-34088","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34088","tags":["report"]},{"url":"https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1265670","tags":["report"]},{"url":"https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1265640","tags":["report"]},{"url":"https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/DIBLSBHISKX6NFRUFNOGZRVW42E7R2QP/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8315-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-34087","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-34092","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-34088","title":"RecentChanges entries expose suppressed content via generated log page html","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.\n\nThis issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.","status":"published","published":"2026-05-11T14:43:44.882Z","modified":"2026-05-11T16:03:31.132Z","cvss":[{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/R:U/RE:M","level":"low","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:20:14.302133Z"}],"euvd":[{"id":"EUVD-2026-29060","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.\n\nThis issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.","status":"published","published":"2026-05-11T14:43:44Z","modified":"2026-05-11T16:03:31Z","cvss":[{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/R:U/RE:M","level":"low"}],"updated_at":"2026-11-02T19:05:10.736891Z"}],"ghsa":[{"id":"GHSA-wpmg-m9mx-w7pj","title":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation...","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.\n\nThis issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.","status":"published","published":"2026-05-11T18:31:43Z","modified":"2026-05-14T18:33:53Z","cvss":[{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:M/U:X","level":"low"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:08:08.953643Z"}],"nvd":[{"id":"CVE-2026-34088","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.\n\nThis issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.","status":"published","published":"2026-05-11T16:17:30.157Z","modified":"2026-10-26T18:10:00.173Z","cvss":[{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:M/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:18.239974Z"}],"osv":[{"id":"CVE-2026-34088","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.\n\nThis issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.","status":"published","published":"2026-05-11T16:17:30.157Z","modified":"2026-10-28T02:31:01.267344193Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:02.247031Z"},{"id":"DEBIAN-CVE-2026-34088","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.  This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.","status":"published","published":"2026-05-11T16:17:30.157Z","modified":"2026-10-27T09:47:30.189330474Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"UBUNTU-CVE-2026-34088","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.","status":"published","published":"2026-05-11T16:17:00Z","modified":"2026-10-17T13:00:01.200380076Z","cvss":[{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/R:U/RE:M","level":"low"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"USN-8315-1","title":"mediawiki vulnerabilities","description":"It was discovered that MediaWiki incorrectly handled group membership \nvisibility in the OATHAuth extension. An authenticated attacker could \nuse this issue to determine if other users had two-factor authentication \nenabled. (CVE-2026-34087)\n\nIt was discovered that MediaWiki incorrectly handled suppressed log entry \ntitles in the RecentChanges list. An unauthenticated attacker could use \nthis issue to view titles of deleted or suppressed pages that should be hidden.\n(CVE-2026-34088)\n\nIt was discovered that MediaWiki incorrectly handled resource loading timing\ninformation. An attacker could use this issue to determine if certain pages \nexisted on a wiki. (CVE-2026-34092)","status":"published","published":"2026-05-27T08:39:27Z","modified":"2026-05-27T15:47:45.721301211Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}