CVE-2025-61646: MediaWiki EnhancedChangesList Vulnerability

CVE-2025-61646 Overview

A vulnerability has been identified in Wikimedia Foundation MediaWiki affecting the includes/RecentChanges/EnhancedChangesList.php component. This security issue impacts MediaWiki installations running versions prior to 1.39.14, 1.43.4, and 1.44.1. The vulnerability is associated with the Enhanced Changes List functionality within the Recent Changes feature of MediaWiki.

Critical Impact
This vulnerability affects MediaWiki's Recent Changes component and could allow authenticated users to access limited confidential information under specific user interaction conditions.

Affected Products

MediaWiki versions before 1.39.14
MediaWiki versions before 1.43.4
MediaWiki versions before 1.44.1

Discovery Timeline

February 3, 2026 - CVE-2025-61646 published to NVD
February 3, 2026 - Last updated in NVD database

Technical Details for CVE-2025-61646

Vulnerability Analysis

This vulnerability resides within the EnhancedChangesList.php file, which is responsible for rendering enhanced recent changes lists in MediaWiki. The Enhanced Changes List feature provides users with a more detailed view of recent modifications to wiki pages, including grouped changes and additional metadata.

The vulnerability requires an authenticated user (low privileges) and depends on user interaction to be exploited. When successfully exploited, it can lead to limited exposure of confidential information. The attack can be performed remotely over the network without requiring complex attack conditions.

Root Cause

The root cause of this vulnerability lies in improper handling within the EnhancedChangesList.php component. The Recent Changes functionality may not properly validate or sanitize certain operations, potentially allowing information to be exposed to users who should not have access to it. The specific implementation flaw allows authenticated users to view limited confidential data through the enhanced changes list interface.

Attack Vector

The attack vector for CVE-2025-61646 is network-based, requiring an authenticated attacker with low-level privileges. The exploitation requires some form of user interaction to succeed. An attacker would need to:

Authenticate to a vulnerable MediaWiki instance
Navigate to or interact with the Recent Changes functionality
Leverage the vulnerability in EnhancedChangesList.php to access information beyond their authorization level

The vulnerability affects only the confidentiality of information, with no impact on integrity or availability of the system.

Detection Methods for CVE-2025-61646

Indicators of Compromise

Unusual access patterns to the Recent Changes pages by authenticated users
Anomalous requests targeting includes/RecentChanges/EnhancedChangesList.php or related endpoints
Unexpected data retrieval attempts through the Enhanced Changes List feature

Detection Strategies

Monitor MediaWiki access logs for suspicious activity related to Recent Changes functionality
Implement application-level logging for the EnhancedChangesList.php component
Review authentication logs for users accessing sensitive recent changes data

Monitoring Recommendations

Enable detailed logging for MediaWiki's Recent Changes module
Configure alerts for unusual access patterns to the Enhanced Changes List feature
Regularly audit user activity related to the affected component

How to Mitigate CVE-2025-61646

Immediate Actions Required

Upgrade MediaWiki installations to version 1.39.14, 1.43.4, or 1.44.1 or later depending on your release branch
Review access logs for any suspicious activity targeting the Recent Changes functionality
Audit user permissions to ensure principle of least privilege is applied

Patch Information

Wikimedia Foundation has addressed this vulnerability in MediaWiki versions 1.39.14, 1.43.4, and 1.44.1. Administrators should upgrade to the appropriate patched version based on their current MediaWiki release branch. For detailed technical information about this vulnerability, refer to the Wikimedia Task T398706.

Workarounds

Restrict access to the Recent Changes functionality to trusted users only if immediate patching is not possible
Implement network-level access controls to limit who can access MediaWiki administrative features
Monitor and audit all access to the Recent Changes pages until patches can be applied

bash

# Check current MediaWiki version
php maintenance/version.php

# Update MediaWiki to patched version (example for git-based installations)
cd /path/to/mediawiki
git fetch origin
git checkout 1.39.14  # or 1.43.4, 1.44.1 depending on your branch

# Run update script after upgrade
php maintenance/update.php