CVE-2026-100241: MediaWiki EventBus Information Disclosure

CVE-2026-100241 Overview

CVE-2026-100241 is an information disclosure vulnerability in the Wikimedia Foundation MediaWiki EventBus Extension. The flaw is classified under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor. It allows an unauthorized actor to perform excavation and retrieve sensitive information from an affected MediaWiki instance.

The issue affects the EventBus Extension shipped with MediaWiki version 1.47.0-alpha. The EventBus Extension forwards MediaWiki events to external event stream infrastructure. Improper handling of exposed data in these event flows creates the disclosure condition described in this advisory.

Critical Impact
An unauthorized actor can extract sensitive data from MediaWiki installations running the vulnerable EventBus Extension, enabling reconnaissance and follow-on attacks against the wiki platform.

Affected Products

Wikimedia Foundation MediaWiki EventBus Extension version 1.47.0-alpha
MediaWiki deployments loading the vulnerable EventBus Extension build
Downstream wikis mirroring the affected Wikimedia code branch

Discovery Timeline

2026-09-29 - CVE-2026-100241 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-100241

Vulnerability Analysis

The vulnerability sits in the EventBus Extension for MediaWiki. EventBus serializes MediaWiki activity into event payloads and dispatches them to downstream consumers. The extension exposes data that should remain restricted to authorized actors.

The advisory categorizes the issue as "Excavation." Excavation attacks probe an application to accumulate information from responses, error output, or side effects. Combined with [CWE-200], this indicates that request patterns against the affected extension return data that the caller should not receive.

The specific fields disclosed and the request path are tracked in the linked Wikimedia references. See the Wikimedia Phabricator Task T432948 and the Wikimedia Gerrit Code Review for the underlying patch discussion.

Root Cause

The root cause is missing or insufficient authorization enforcement on data emitted by the EventBus Extension. Sensitive attributes flow into event output paths without a check confirming the requester is entitled to see them. The regression is present in the 1.47.0-alpha branch of the extension.

Attack Vector

An unauthorized actor issues crafted requests or observes event outputs from a MediaWiki instance running the vulnerable EventBus Extension. The response or event payload contains fields that leak sensitive information. No privileged credentials are required for the excavation pattern described.

No public exploit code, proof-of-concept, or in-the-wild exploitation has been reported for this CVE. The mechanics of the disclosure are documented in the Wikimedia references linked above; refer to the Gerrit change for the exact code path corrected by the fix.

Detection Methods for CVE-2026-100241

Indicators of Compromise

Repeated anonymous requests to MediaWiki endpoints backed by the EventBus Extension
Unusual enumeration patterns across event-producing routes such as page edits, revisions, or user actions
Outbound event streams containing fields not intended for public consumers

Detection Strategies

Inventory MediaWiki hosts and confirm whether the EventBus Extension is loaded and at which version.
Review web server and application logs for high-volume, low-diversity requests targeting EventBus-integrated endpoints.
Compare event payloads emitted to downstream consumers against the schema expected for unauthenticated contexts.

Monitoring Recommendations

Alert on spikes in anonymous API traffic against MediaWiki instances that run the EventBus Extension.
Log and retain full request and response metadata for EventBus-related routes to support incident review.
Monitor Kafka or downstream event consumers for payload fields that should be filtered before publication.

How to Mitigate CVE-2026-100241

Immediate Actions Required

Identify all MediaWiki instances running the EventBus Extension at version 1.47.0-alpha.
Apply the fix referenced in the Wikimedia Gerrit Code Review once merged into a released build.
Restrict network access to MediaWiki API endpoints from untrusted networks until the patch is deployed.

Patch Information

The fix is tracked in Wikimedia Gerrit under change I6d79037edc771fe9a2889c543e12cf7b1296aab8 and in Wikimedia Phabricator Task T432948. Operators running the 1.47.0-alpha branch of the EventBus Extension should update to the patched revision or a subsequent release that incorporates the change. Alpha builds should not be exposed to production traffic pending the corrected version.

Workarounds

Disable the EventBus Extension in MediaWiki LocalSettings.php if the extension is not required for operations.
Place the wiki behind an authenticated reverse proxy while the vulnerable version remains deployed.
Filter outbound event payloads at the consumer or broker layer to strip fields that should not reach unauthorized parties.

bash

# Configuration example: disable the EventBus Extension in MediaWiki
# Comment out or remove the following line in LocalSettings.php
# wfLoadExtension( 'EventBus' );