CVE-2025-67478: CheckUser Information Disclosure Flaw

CVE-2025-67478 Overview

A vulnerability has been identified in the Wikimedia Foundation CheckUser extension. This security issue is associated with the includes/Mail/UserMailer.php program file within the CheckUser codebase. The vulnerability affects CheckUser versions prior to 1.39.14, 1.43.4, and 1.44.1.

Critical Impact
This vulnerability in the CheckUser extension's mail handling component could potentially impact wiki installations running affected versions of the extension.

Affected Products

Wikimedia Foundation CheckUser versions before 1.39.14
Wikimedia Foundation CheckUser versions before 1.43.4
Wikimedia Foundation CheckUser versions before 1.44.1

Discovery Timeline

2026-02-03 - CVE CVE-2025-67478 published to NVD
2026-02-03 - Last updated in NVD database

Technical Details for CVE-2025-67478

Vulnerability Analysis

The vulnerability resides within the UserMailer.php file in the CheckUser extension's mail handling functionality. CheckUser is a MediaWiki extension that provides administrators with capabilities to check user IP addresses and related information for anti-abuse purposes. The affected component handles email operations within the extension.

Based on the network-based attack vector, this vulnerability can be exploited remotely without requiring special privileges, though user interaction is needed for successful exploitation. The vulnerability appears to be in the early stages of analysis, with limited public technical details currently available.

Root Cause

The root cause stems from an issue within the includes/Mail/UserMailer.php file. While specific technical details have not been fully disclosed, the vulnerability is associated with the mail handling functionality of the CheckUser extension. The affected file handles user email operations, and the flaw may involve improper handling of mail-related inputs or operations.

Attack Vector

The vulnerability is exploitable via network access. An attacker would need to target systems running vulnerable versions of the CheckUser extension. User interaction is required for successful exploitation, suggesting this may involve social engineering or require a user to perform specific actions that trigger the vulnerable code path.

For technical details regarding this vulnerability, refer to the Wikimedia Task Discussion on Phabricator.

Detection Methods for CVE-2025-67478

Indicators of Compromise

Unusual activity in CheckUser extension logs related to mail operations
Unexpected email generation or delivery attempts from the wiki server
Anomalous requests targeting the UserMailer.php component

Detection Strategies

Monitor web server logs for suspicious requests to CheckUser extension endpoints
Review MediaWiki error logs for exceptions related to includes/Mail/UserMailer.php
Implement file integrity monitoring on the CheckUser extension directory

Monitoring Recommendations

Enable verbose logging for the CheckUser extension to capture potential exploitation attempts
Set up alerts for unusual patterns in outgoing email traffic from wiki servers
Monitor for unauthorized modifications to CheckUser extension files

How to Mitigate CVE-2025-67478

Immediate Actions Required

Update CheckUser extension to version 1.39.14, 1.43.4, or 1.44.1 depending on your MediaWiki branch
Review CheckUser extension logs for any signs of exploitation
Temporarily disable the CheckUser extension if immediate patching is not possible

Patch Information

Wikimedia Foundation has released patched versions addressing this vulnerability. Administrators should update to CheckUser version 1.39.14, 1.43.4, or 1.44.1 based on their MediaWiki installation branch. Additional details can be found in the Wikimedia Task Discussion.

Workarounds

Restrict access to CheckUser functionality to only essential administrators
Implement network-level controls to limit access to wiki administration interfaces
Consider disabling the mail functionality within the CheckUser extension until patches can be applied

bash

# Configuration example - Restricting CheckUser access in LocalSettings.php
$wgGroupPermissions['*']['checkuser'] = false;
$wgGroupPermissions['sysop']['checkuser'] = false;
$wgGroupPermissions['checkuser']['checkuser'] = true;