CVE-2026-100244: MediaWiki CentralAuth Information Disclosure

CVE-2026-100244 Overview

CVE-2026-100244 is an information disclosure vulnerability in the Wikimedia Foundation MediaWiki CentralAuth extension. The flaw exposes sensitive information to unauthorized actors through data excavation techniques. CentralAuth manages unified login across Wikimedia wiki farms, so any leakage affects global account metadata. The issue is classified under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor. Affected releases include CentralAuth versions prior to 1.46.1, 1.45.5, and 1.43.10. Wikimedia tracks the fix under Phabricator task T432789 and Gerrit change Ifd262c11300dd0355e177d6185bcd704d2720a47.

Critical Impact
Unauthorized actors can excavate sensitive account or session data from MediaWiki installations running vulnerable CentralAuth versions, aiding reconnaissance and follow-on attacks.

Affected Products

MediaWiki CentralAuth Extension versions before 1.46.1
MediaWiki CentralAuth Extension versions before 1.45.5
MediaWiki CentralAuth Extension versions before 1.43.10

Discovery Timeline

2026-09-29 - CVE-2026-100244 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-100244

Vulnerability Analysis

The CentralAuth extension provides shared authentication and global account management across MediaWiki wiki farms. CVE-2026-100244 describes an information exposure weakness that allows an unauthorized actor to excavate sensitive data by querying or observing exposed endpoints, responses, or metadata. Excavation refers to systematic extraction of data that should not be reachable by the requesting principal.

The Wikimedia Phabricator task T432789 and the Gerrit change Ifd262c11300dd0355e177d6185bcd704d2720a47 contain the remediation. Public NVD data does not describe the exact endpoint or data element exposed. Operators of Wikimedia sites, third-party wiki farms, and enterprise MediaWiki deployments with CentralAuth should treat this as an authorization or data-scoping defect within CentralAuth request handling.

Root Cause

The root cause is improper restriction of sensitive information within CentralAuth ([CWE-200]). CentralAuth returned or exposed data to callers who lacked the authorization or context required to receive it. See the Wikimedia Gerrit Code Review for the corrective patch.

Attack Vector

MediaWiki extensions are exposed over HTTP(S), so the practical attack vector is a crafted request to a vulnerable CentralAuth code path. An attacker with network reachability to a wiki running an unpatched CentralAuth version can iterate requests to enumerate or reconstruct sensitive information. Authentication requirements and privilege prerequisites are not documented in the current NVD entry. Refer to the Wikimedia Phabricator Task T432789 for additional technical context as Wikimedia publishes it.

Detection Methods for CVE-2026-100244

Indicators of Compromise

Unusual volumes of requests to CentralAuth endpoints such as /wiki/Special:CentralAuth or associated API modules from a single client or ASN.
Sequential or enumerative access patterns against user, account, or session-related CentralAuth resources.
Requests originating from anonymous or low-privilege sessions that return data fields normally reserved for authenticated or privileged users.

Detection Strategies

Inventory MediaWiki installations and confirm the CentralAuth extension version against 1.46.1, 1.45.5, and 1.43.10.
Review web server and MediaWiki access logs for spikes in Special:CentralAuth and CentralAuth API endpoint activity.
Correlate response sizes and status codes to identify enumeration behavior against user or account resources.

Monitoring Recommendations

Enable verbose logging on CentralAuth API modules and forward logs to a centralized analytics platform.
Alert on repeated unauthenticated access to account-scoped CentralAuth endpoints.
Track post-patch traffic for continued scraping attempts that may indicate targeted reconnaissance.

How to Mitigate CVE-2026-100244

Immediate Actions Required

Upgrade CentralAuth to 1.46.1, 1.45.5, or 1.43.10 depending on the MediaWiki release branch in use.
Restrict network access to administrative and account-management endpoints where operationally feasible.
Review CentralAuth access logs for prior enumeration activity that predates the upgrade.

Patch Information

Wikimedia has published fixes in CentralAuth 1.46.1, 1.45.5, and 1.43.10. The corrective code change is tracked in Wikimedia Gerrit Code Review Ifd262c11300dd0355e177d6185bcd704d2720a47 and the associated Wikimedia Phabricator Task T432789. Apply the upgrade using the standard MediaWiki extension update procedure and run php maintenance/update.php if schema updates are required.

Workarounds

Place a reverse proxy or web application firewall rule in front of MediaWiki to rate-limit and inspect requests to CentralAuth endpoints.
Temporarily restrict access to Special:CentralAuth and related API modules to authenticated administrators until the patch is deployed.
Disable CentralAuth on non-essential wikis if the extension is not required for federated login.

bash

# Example: rate-limit CentralAuth endpoints in nginx
limit_req_zone $binary_remote_addr zone=centralauth:10m rate=5r/s;

location ~ ^/wiki/Special:CentralAuth {
    limit_req zone=centralauth burst=10 nodelay;
    proxy_pass http://mediawiki_backend;
}