CVE-2025-61646 Overview
A vulnerability has been identified in Wikimedia Foundation MediaWiki affecting the includes/RecentChanges/EnhancedChangesList.php component. This security issue impacts MediaWiki installations running versions prior to 1.39.14, 1.43.4, and 1.44.1. The vulnerability is associated with the Enhanced Changes List functionality within the Recent Changes feature of MediaWiki.
Critical Impact
This vulnerability affects MediaWiki's Recent Changes component and could allow authenticated users to access limited confidential information under specific user interaction conditions.
Affected Products
- MediaWiki versions before 1.39.14
- MediaWiki versions before 1.43.4
- MediaWiki versions before 1.44.1
Discovery Timeline
- February 3, 2026 - CVE-2025-61646 published to NVD
- February 3, 2026 - Last updated in NVD database
Technical Details for CVE-2025-61646
Vulnerability Analysis
This vulnerability resides within the EnhancedChangesList.php file, which is responsible for rendering enhanced recent changes lists in MediaWiki. The Enhanced Changes List feature provides users with a more detailed view of recent modifications to wiki pages, including grouped changes and additional metadata.
The vulnerability requires an authenticated user (low privileges) and depends on user interaction to be exploited. When successfully exploited, it can lead to limited exposure of confidential information. The attack can be performed remotely over the network without requiring complex attack conditions.
Root Cause
The root cause of this vulnerability lies in improper handling within the EnhancedChangesList.php component. The Recent Changes functionality may not properly validate or sanitize certain operations, potentially allowing information to be exposed to users who should not have access to it. The specific implementation flaw allows authenticated users to view limited confidential data through the enhanced changes list interface.
Attack Vector
The attack vector for CVE-2025-61646 is network-based, requiring an authenticated attacker with low-level privileges. The exploitation requires some form of user interaction to succeed. An attacker would need to:
- Authenticate to a vulnerable MediaWiki instance
- Navigate to or interact with the Recent Changes functionality
- Leverage the vulnerability in EnhancedChangesList.php to access information beyond their authorization level
The vulnerability affects only the confidentiality of information, with no impact on integrity or availability of the system.
Detection Methods for CVE-2025-61646
Indicators of Compromise
- Unusual access patterns to the Recent Changes pages by authenticated users
- Anomalous requests targeting includes/RecentChanges/EnhancedChangesList.php or related endpoints
- Unexpected data retrieval attempts through the Enhanced Changes List feature
Detection Strategies
- Monitor MediaWiki access logs for suspicious activity related to Recent Changes functionality
- Implement application-level logging for the EnhancedChangesList.php component
- Review authentication logs for users accessing sensitive recent changes data
Monitoring Recommendations
- Enable detailed logging for MediaWiki's Recent Changes module
- Configure alerts for unusual access patterns to the Enhanced Changes List feature
- Regularly audit user activity related to the affected component
How to Mitigate CVE-2025-61646
Immediate Actions Required
- Upgrade MediaWiki installations to version 1.39.14, 1.43.4, or 1.44.1 or later depending on your release branch
- Review access logs for any suspicious activity targeting the Recent Changes functionality
- Audit user permissions to ensure principle of least privilege is applied
Patch Information
Wikimedia Foundation has addressed this vulnerability in MediaWiki versions 1.39.14, 1.43.4, and 1.44.1. Administrators should upgrade to the appropriate patched version based on their current MediaWiki release branch. For detailed technical information about this vulnerability, refer to the Wikimedia Task T398706.
Workarounds
- Restrict access to the Recent Changes functionality to trusted users only if immediate patching is not possible
- Implement network-level access controls to limit who can access MediaWiki administrative features
- Monitor and audit all access to the Recent Changes pages until patches can be applied
# Check current MediaWiki version
php maintenance/version.php
# Update MediaWiki to patched version (example for git-based installations)
cd /path/to/mediawiki
git fetch origin
git checkout 1.39.14 # or 1.43.4, 1.44.1 depending on your branch
# Run update script after upgrade
php maintenance/update.php
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
