CVE-2023-37252: MediaWiki CheckUser Information Disclosure

CVE-2023-37252 Overview

CVE-2023-37252 affects the CheckUser extension for MediaWiki through version 1.39.3. The Special:CheckUserLog page discloses usernames that administrators previously hid through MediaWiki's user suppression functionality. This defeats the privacy protection that hiding a username is meant to provide.

The issue is categorized as [CWE-669] Incorrect Resource Transfer Between Spheres. Attackers with access to CheckUser log entries can view identifiers that should remain suppressed from view.

Critical Impact
Hidden usernames leak through Special:CheckUserLog, undermining privacy controls for suppressed accounts on affected MediaWiki installations.

Affected Products

MediaWiki CheckUser extension through version 1.39.3
MediaWiki installations with the CheckUser extension enabled
Wiki farms relying on username suppression for privacy

Discovery Timeline

2026-09-14 - CVE-2023-37252 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2023-37252

Vulnerability Analysis

The CheckUser extension provides MediaWiki administrators with tools to investigate account activity, including IP addresses and user agents tied to edits. Its audit trail lives at Special:CheckUserLog, which records every CheckUser query performed on the wiki.

MediaWiki separately supports suppressing usernames. When an administrator hides a username, standard wiki surfaces should replace the identifier with a placeholder so viewers cannot associate the account with prior activity. Special:CheckUserLog failed to apply this suppression to its stored log entries, exposing the hidden usernames to users authorized to review CheckUser activity.

The issue is an information disclosure flaw. It does not permit code execution or modification of wiki content, but it breaks a privacy control that operators and communities depend on. Exploitation requires prior privileges to view the CheckUser log, which limits the pool of potential viewers to trusted users. Additional context is available in Wikimedia Task T330968.

Root Cause

The CheckUser extension did not consult the user-hiding state when rendering historical log rows in Special:CheckUserLog. Log entries retained the raw username field and displayed it verbatim, bypassing the suppression logic applied elsewhere in MediaWiki.

Attack Vector

A user with permission to view Special:CheckUserLog browses the log and reads the usernames that appear in historical entries. No crafted request or injection is required. The disclosure surfaces through normal use of the log interface.

No public exploit code has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2023-37252

Indicators of Compromise

Access records for Special:CheckUserLog from accounts that hold CheckUser rights but have no operational reason to review the log.
Complaints or off-wiki reports referencing usernames that were previously suppressed on the wiki.
Log rows in cu_log that reference target usernames matching entries in the user suppression table.

Detection Strategies

Review MediaWiki access logs for anomalous read volume against Special:CheckUserLog by any single account.
Cross-reference CheckUser log entries against the list of hidden accounts to identify residual disclosures prior to patching.
Enable and centralize MediaWiki audit logging so CheckUser activity is retained outside the wiki database.

Monitoring Recommendations

Forward MediaWiki web server logs to a centralized log platform and alert on repeated Special:CheckUserLog reads.
Track membership changes to the checkuser and suppress user groups and require justification for additions.
Periodically audit which accounts hold CheckUser rights and revoke access from inactive users.

How to Mitigate CVE-2023-37252

Immediate Actions Required

Upgrade the CheckUser extension to a version released after MediaWiki 1.39.3 that incorporates the fix referenced in Wikimedia Task T330968.
Restrict the checkuser right to the minimum number of trusted administrators required for wiki operations.
Review historical Special:CheckUserLog output for any suppressed usernames that were disclosed prior to remediation.

Patch Information

The Wikimedia Foundation tracks the fix under Wikimedia Task T330968. Apply the patched CheckUser extension bundled with the corresponding MediaWiki security release. Verify the installed extension version through Special:Version after upgrading.

Workarounds

Remove or disable the CheckUser extension in environments where the audit trail cannot be immediately upgraded.
Limit the checkuser-log permission to a small, vetted group until the patch is deployed.
Purge sensitive rows from the cu_log table where suppressed usernames appear, following the vendor task guidance.

bash

# Verify installed CheckUser extension version
php maintenance/version.php

# Restrict access to CheckUserLog via LocalSettings.php
$wgGroupPermissions['checkuser']['checkuser-log'] = true;
$wgGroupPermissions['*']['checkuser-log'] = false;
$wgGroupPermissions['user']['checkuser-log'] = false;