CVE-2026-34093 Overview
CVE-2026-34093 is an information disclosure vulnerability in Wikimedia Foundation MediaWiki. The flaw resides in the includes/Specials/SpecialUserRights.php component and exposes sensitive information to an unauthorized actor. The issue is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
The vulnerability affects MediaWiki versions prior to 1.43.7, 1.44.4, and 1.45.2. An authenticated actor with low privileges can interact with the Special:UserRights interface to retrieve information they should not be able to view.
Critical Impact
An authenticated low-privileged user can retrieve sensitive information through the SpecialUserRights.php endpoint, leading to limited confidentiality loss across affected MediaWiki installations.
Affected Products
- Wikimedia Foundation MediaWiki versions before 1.43.7
- Wikimedia Foundation MediaWiki versions before 1.44.4
- Wikimedia Foundation MediaWiki versions before 1.45.2
Discovery Timeline
- 2026-05-11 - CVE-2026-34093 published to NVD
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2026-34093
Vulnerability Analysis
The vulnerability is an information disclosure issue in the MediaWiki Special:UserRights interface, implemented in includes/Specials/SpecialUserRights.php. This special page manages user group memberships and rights changes. The component fails to properly restrict the exposure of sensitive information to unauthorized actors.
Exploitation requires network access to the MediaWiki instance, authentication with low privileges, and some form of user interaction. The Exploit Prediction Scoring System rates the likelihood of exploitation as very low, and no public proof-of-concept or in-the-wild exploitation has been reported.
The practical impact is limited confidentiality loss. Integrity and availability are not affected. Administrators of public wikis and multi-tenant MediaWiki deployments should still treat the issue as relevant because the affected endpoint is reachable by any authenticated contributor.
Root Cause
The root cause is improper access control around data rendered or returned by SpecialUserRights.php. The component returns information about user rights or related metadata in a context where the requesting actor does not have authorization to view that data. This aligns with the [CWE-200] classification of exposing sensitive information to an unauthorized actor.
Attack Vector
The attack vector is network-based. An authenticated user navigates to the Special:UserRights page on a vulnerable MediaWiki instance and triggers the disclosure through normal request flow. No specialized tooling is required, but user interaction is necessary to invoke the vulnerable path. Refer to the Wikimedia Task T414547 tracking entry for additional technical context.
Detection Methods for CVE-2026-34093
Indicators of Compromise
- Unusual or repeated access patterns to the Special:UserRights page from low-privileged accounts.
- Web server access logs showing high-volume GET requests to index.php?title=Special:UserRights from non-administrator users.
- Authenticated sessions enumerating user rights data outside of normal administrative workflows.
Detection Strategies
- Audit MediaWiki access logs for requests to SpecialUserRights.php originating from accounts without the userrights permission.
- Correlate authenticated session activity with subsequent access to user account or rights data to surface enumeration behavior.
- Verify the installed MediaWiki version against the fixed releases 1.43.7, 1.44.4, and 1.45.2.
Monitoring Recommendations
- Enable verbose logging on the MediaWiki web tier and forward logs to a centralized analytics platform.
- Alert on access to Special:UserRights by accounts that do not hold rights-management privileges.
- Track changes to MediaWiki core files under includes/Specials/ to detect tampering or rollback to vulnerable versions.
How to Mitigate CVE-2026-34093
Immediate Actions Required
- Upgrade MediaWiki to version 1.43.7, 1.44.4, or 1.45.2 depending on the deployed release branch.
- Inventory all MediaWiki instances, including development and staging environments, to confirm patch coverage.
- Review account permissions and remove unused or stale low-privileged accounts that could be leveraged to reach the vulnerable endpoint.
Patch Information
Wikimedia Foundation has released fixed versions 1.43.7, 1.44.4, and 1.45.2. Administrators should apply the upgrade that matches their current release branch. See the Wikimedia Task T414547 tracking entry for patch details.
Workarounds
- Restrict access to the Special:UserRights page through reverse-proxy access control rules until the patch is applied.
- Require multi-factor authentication for all editor and contributor accounts to reduce abuse of low-privileged sessions.
- Limit account registration on public wikis to vetted users while remediation is in progress.
# Configuration example: upgrade MediaWiki to a fixed release
cd /var/www/mediawiki
php maintenance/update.php --quick
# Verify the installed version after upgrade
php maintenance/version.php
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
