{"id":"CVE-2026-34092","aliases":["DEBIAN-CVE-2026-34092","EUVD-2026-29064","GHSA-rg4j-v2c4-8gfh","UBUNTU-CVE-2026-34092","USN-8315-1"],"status":"published","title":"Block UI elements in 'tools'-sidebar shows presence of an autoblocked IP","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.\n\n This vulnerability is associated with program files includes/Skin/Skin.Php.\n\n\n\nThis issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.","severity":{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00237,"percentile":0.14815,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2026-05-11T15:00:29Z","modified":"2026-10-27T02:30:25Z","fixes":[{"ecosystem":"Debian:12","package":"mediawiki","fixed_in":["1:1.39.17-1+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mediawiki","fixed_in":["1:1.43.8+dfsg-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mediawiki","fixed_in":["1:1.43.8+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"mediawiki","fixed_in":["1:1.39.7-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"mediawiki","fixed_in":["1:1.43.8+dfsg-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"mediawiki","fixed_in":["1:1.43.8+dfsg-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.39.17-1+deb12u2"}]}],"versions":["1:1.39.10-1","1:1.39.10-1~deb12u1","1:1.39.12-1~deb12u1","1:1.39.13-1~deb12u1","1:1.39.17-1~deb12u1","1:1.39.2-1","1:1.39.4-1","1:1.39.4-1~deb12u1","1:1.39.4-2","1:1.39.5-1","1:1.39.5-1~deb12u1","1:1.39.6-1","1:1.39.7-1","1:1.39.7-1~deb12u1","1:1.39.8-1"]},{"source":"osv","ecosystem":"Debian:13","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.43.8+dfsg-1~deb13u1"}]}],"versions":["1:1.43.3+dfsg-1","1:1.43.5+dfsg-1","1:1.43.6+dfsg-1","1:1.43.6+dfsg-1~deb13u1","1:1.43.6+dfsg-2"]},{"source":"osv","ecosystem":"Debian:14","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.43.8+dfsg-1"}]}],"versions":["1:1.43.3+dfsg-1","1:1.43.5+dfsg-1","1:1.43.6+dfsg-1","1:1.43.6+dfsg-1~deb13u1","1:1.43.6+dfsg-2","1:1.43.8+dfsg-1~deb13u1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.39.7-1ubuntu0.1~esm1"}]}],"versions":["1:1.39.4-2","1:1.39.5-1","1:1.39.6-1","1:1.39.7-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.43.1+dfsg-1","1:1.43.1+dfsg-2","1:1.43.3+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.43.8+dfsg-2"}]}]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.43.8+dfsg-2"}]}],"versions":["1:1.43.3+dfsg-1","1:1.43.5+dfsg-1","1:1.43.6+dfsg-2","1:1.43.8+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.31.7-1ubuntu0.1~esm1"}]}],"versions":["1:1.31.2-1ubuntu1","1:1.31.5-1","1:1.31.5-1ubuntu1","1:1.31.5-2","1:1.31.5-3","1:1.31.5-3ubuntu1","1:1.31.6-1","1:1.31.7-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.6-1ubuntu0.1~esm1"}]}],"versions":["1:1.35.3-1","1:1.35.4-1","1:1.35.5-1","1:1.35.5-1ubuntu1","1:1.35.5-1ubuntu2","1:1.35.5-1ubuntu3","1:1.35.6-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.39.7-1ubuntu0.1~esm1"}]}],"versions":["1:1.39.4-2","1:1.39.5-1","1:1.39.6-1","1:1.39.7-1"],"bundled":3}],"products":[{"vendor":"mediawiki","product":"mediawiki"},{"vendor":"wikimedia foundation","product":"mediawiki"}],"references":[{"url":"https://phabricator.wikimedia.org/T384147","tags":["Issue Tracking","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34092"},{"url":"https://github.com/advisories/GHSA-rg4j-v2c4-8gfh"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-34092","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-34092","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34092","tags":["report"]},{"url":"https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1265652","tags":["report"]},{"url":"https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1265638","tags":["report"]},{"url":"https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/DIBLSBHISKX6NFRUFNOGZRVW42E7R2QP/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8315-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-34087","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-34088","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-34092","title":"Block UI elements in 'tools'-sidebar shows presence of an autoblocked IP","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.\n\n This vulnerability is associated with program files includes/Skin/Skin.Php.\n\n\n\nThis issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.","status":"published","published":"2026-05-11T15:00:29.819Z","modified":"2026-05-11T15:50:58.247Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:20:14.302133Z"}],"euvd":[{"id":"EUVD-2026-29064","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.\n\n This vulnerability is associated with program files includes/Skin/Skin.Php.\n\n\n\nThis issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.","status":"published","published":"2026-05-11T15:00:29Z","modified":"2026-05-11T15:50:58Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T19:05:10.736891Z"}],"ghsa":[{"id":"GHSA-rg4j-v2c4-8gfh","title":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation...","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.\n\n This vulnerability is associated with program files includes/Skin/Skin.Php.\n\n\n\nThis issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.","status":"published","published":"2026-05-11T18:31:43Z","modified":"2026-05-14T18:33:53Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:08:08.953643Z"}],"nvd":[{"id":"CVE-2026-34092","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.\n\n This vulnerability is associated with program files includes/Skin/Skin.Php.\n\n\n\nThis issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.","status":"published","published":"2026-05-11T16:17:30.663Z","modified":"2026-10-26T00:10:00.15Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:18.239974Z"}],"osv":[{"id":"CVE-2026-34092","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.\n\n This vulnerability is associated with program files includes/Skin/Skin.Php.\n\n\n\nThis issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.","status":"published","published":"2026-05-11T16:17:30.663Z","modified":"2026-10-27T02:30:25.318662375Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:02.247031Z"},{"id":"DEBIAN-CVE-2026-34092","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.   This vulnerability is associated with program files includes/Skin/Skin.Php.    This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.","status":"published","published":"2026-05-11T16:17:30.663Z","modified":"2026-10-26T11:47:30.415300876Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"UBUNTU-CVE-2026-34092","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.  This vulnerability is associated with program files includes/Skin/Skin.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.","status":"published","published":"2026-05-11T16:17:00Z","modified":"2026-10-17T12:58:11.59514309Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"USN-8315-1","title":"mediawiki vulnerabilities","description":"It was discovered that MediaWiki incorrectly handled group membership \nvisibility in the OATHAuth extension. An authenticated attacker could \nuse this issue to determine if other users had two-factor authentication \nenabled. (CVE-2026-34087)\n\nIt was discovered that MediaWiki incorrectly handled suppressed log entry \ntitles in the RecentChanges list. An unauthenticated attacker could use \nthis issue to view titles of deleted or suppressed pages that should be hidden.\n(CVE-2026-34088)\n\nIt was discovered that MediaWiki incorrectly handled resource loading timing\ninformation. An attacker could use this issue to determine if certain pages \nexisted on a wiki. (CVE-2026-34092)","status":"published","published":"2026-05-27T08:39:27Z","modified":"2026-05-27T15:47:45.721301211Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}