CVE-2025-67478: CheckUser Information Disclosure Flaw

CVE-2025-67478 Overview

A vulnerability has been identified in the Wikimedia Foundation CheckUser extension. This security issue is associated with the includes/Mail/UserMailer.php program file within the CheckUser codebase. The vulnerability affects CheckUser versions prior to 1.39.14, 1.43.4, and 1.44.1.

Critical Impact

This vulnerability in the CheckUser extension's mail handling component could potentially impact wiki installations running affected versions of the extension.

Affected Products

• Wikimedia Foundation CheckUser versions before 1.39.14
• Wikimedia Foundation CheckUser versions before 1.43.4
• Wikimedia Foundation CheckUser versions before 1.44.1

Discovery Timeline

• 2026-02-03 - CVE CVE-2025-67478 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2025-67478

Vulnerability Analysis

The vulnerability resides within the UserMailer.php file in the CheckUser extension's mail handling functionality. CheckUser is a MediaWiki extension that provides administrators with capabilities to check user IP addresses and related information for anti-abuse purposes. The affected component handles email operations within the extension.

Based on the network-based attack vector, this vulnerability can be exploited remotely without requiring special privileges, though user interaction is needed for successful exploitation. The vulnerability appears to be in the early stages of analysis, with limited public technical details currently available.

Root Cause

The root cause stems from an issue within the includes/Mail/UserMailer.php file. While specific technical details have not been fully disclosed, the vulnerability is associated with the mail handling functionality of the CheckUser extension. The affected file handles user email operations, and the flaw may involve improper handling of mail-related inputs or operations.

Attack Vector

The vulnerability is exploitable via network access. An attacker would need to target systems running vulnerable versions of the CheckUser extension. User interaction is required for successful exploitation, suggesting this may involve social engineering or require a user to perform specific actions that trigger the vulnerable code path.

For technical details regarding this vulnerability, refer to the Wikimedia Task Discussion on Phabricator.

Detection Methods for CVE-2025-67478

Indicators of Compromise

• Unusual activity in CheckUser extension logs related to mail operations
• Unexpected email generation or delivery attempts from the wiki server
• Anomalous requests targeting the UserMailer.php component

Detection Strategies

• Monitor web server logs for suspicious requests to CheckUser extension endpoints
• Review MediaWiki error logs for exceptions related to includes/Mail/UserMailer.php
• Implement file integrity monitoring on the CheckUser extension directory

Monitoring Recommendations

• Enable verbose logging for the CheckUser extension to capture potential exploitation attempts
• Set up alerts for unusual patterns in outgoing email traffic from wiki servers
• Monitor for unauthorized modifications to CheckUser extension files

How to Mitigate CVE-2025-67478

Immediate Actions Required

• Update CheckUser extension to version 1.39.14, 1.43.4, or 1.44.1 depending on your MediaWiki branch
• Review CheckUser extension logs for any signs of exploitation
• Temporarily disable the CheckUser extension if immediate patching is not possible

Patch Information

Wikimedia Foundation has released patched versions addressing this vulnerability. Administrators should update to CheckUser version 1.39.14, 1.43.4, or 1.44.1 based on their MediaWiki installation branch. Additional details can be found in the Wikimedia Task Discussion.

Workarounds

• Restrict access to CheckUser functionality to only essential administrators
• Implement network-level controls to limit access to wiki administration interfaces
• Consider disabling the mail functionality within the CheckUser extension until patches can be applied

# Configuration example - Restricting CheckUser access in LocalSettings.php
$wgGroupPermissions['*']['checkuser'] = false;
$wgGroupPermissions['sysop']['checkuser'] = false;
$wgGroupPermissions['checkuser']['checkuser'] = true;