CVE-2026-34092: MediaWiki Information Disclosure Flaw

CVE-2026-34092 Overview

CVE-2026-34092 is an information disclosure vulnerability in Wikimedia Foundation MediaWiki, the open-source wiki engine that powers Wikipedia and thousands of other public and private wikis. The flaw resides in the includes/Skin/Skin.php component and exposes sensitive information to unauthorized actors [CWE-200]. The issue affects MediaWiki releases prior to 1.43.7, 1.44.4, and 1.45.2. An authenticated user with low privileges can interact with the vulnerable skin code path and observe data that should remain restricted.

Critical Impact

An authenticated low-privilege attacker can retrieve sensitive information through the Skin.php component, undermining the confidentiality of wiki content and metadata.

Affected Products

• MediaWiki versions before 1.43.7
• MediaWiki versions before 1.44.4
• MediaWiki versions before 1.45.2

Discovery Timeline

• 2026-05-11 - CVE-2026-34092 published to the National Vulnerability Database (NVD)
• 2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-34092

Vulnerability Analysis

The vulnerability is categorized as Information Exposure [CWE-200] within MediaWiki's skin rendering subsystem. MediaWiki uses skins to render the user interface around wiki content, and the affected includes/Skin/Skin.php file is central to that rendering pipeline. The flaw causes the skin code to return information to a requesting user that the application should have restricted based on access controls. The vector requires network access, low privileges, and some user interaction, which limits broad opportunistic exploitation but remains relevant on multi-user wikis where account creation is permitted. With an EPSS probability of 0.034%, observed exploitation likelihood is low.

Root Cause

The root cause is improper access control over data surfaced by skin rendering logic in includes/Skin/Skin.php. The component does not consistently filter output based on the viewer's permissions, allowing data intended for privileged contexts to be rendered for users who should not see it. The condition aligns with CWE-200, Exposure of Sensitive Information to an Unauthorized Actor.

Attack Vector

An attacker authenticates to the target MediaWiki instance with a low-privilege account, then triggers a skin-rendered view that causes Skin.php to disclose restricted data. The attack is network-reachable over standard HTTP/HTTPS interfaces and requires user interaction to reach the vulnerable rendering path. No verified public proof-of-concept code is currently available. See the Wikimedia Task T384147 for vendor-tracked technical details.

Detection Methods for CVE-2026-34092

Indicators of Compromise

• Unusual volumes of authenticated requests to skin-rendered endpoints from low-privilege accounts.
• Access patterns where standard user sessions retrieve pages that include data normally restricted to administrators or specific user groups.
• Anomalous referrers or scripted user-agents repeatedly fetching the same skin-rendered views.

Detection Strategies

• Review MediaWiki access logs for repeated requests originating from newly created or low-reputation accounts targeting skin-rendered pages.
• Compare rendered page content against expected per-role visibility to identify cases where restricted fields are exposed.
• Audit MediaWiki version strings on managed wikis to confirm whether instances run vulnerable releases below 1.43.7, 1.44.4, or 1.45.2.

Monitoring Recommendations

• Forward MediaWiki web server and application logs to a centralized analytics or SIEM platform for correlation across user sessions.
• Establish baselines for authenticated request rates per user role and alert on deviations.
• Track the appearance of MediaWiki version banners and Special:Version output across the estate to confirm patch posture.

How to Mitigate CVE-2026-34092

Immediate Actions Required

• Upgrade MediaWiki to 1.43.7, 1.44.4, or 1.45.2 or later, depending on the deployed branch.
• Inventory all MediaWiki instances, including non-production wikis, and confirm version status.
• Review user and group permissions to ensure low-privilege roles do not have access beyond what is required.

Patch Information

The Wikimedia Foundation has released fixed versions 1.43.7, 1.44.4, and 1.45.2. Refer to the Wikimedia Task T384147 for the authoritative remediation reference. Apply the upgrade through standard MediaWiki update procedures and run php maintenance/update.php after deployment.

Workarounds

• Restrict account self-registration on public wikis to limit who can reach the authenticated attack surface.
• Apply web application firewall rules to limit anonymous and low-privilege access to skin-rendered endpoints where feasible.
• Temporarily reduce the data surfaced through customized skins until patches are applied.

# Configuration example: verify installed MediaWiki version and apply update
php maintenance/version.php
# After upgrading source tree to 1.43.7 / 1.44.4 / 1.45.2:
php maintenance/update.php --quick