CVE-2026-5266 Overview
CVE-2026-5266 is an information disclosure vulnerability in the Wikimedia Foundation Echo extension for MediaWiki. The flaw resides in the includes/Api/ApiEchoNotifications.Php program file and exposes sensitive information to unauthorized actors. The issue is classified under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor. Affected releases include Echo versions prior to 1.43.7, 1.44.4, and 1.45.2. An attacker with low privileges on the network can query the notifications API and retrieve information that should remain restricted.
Critical Impact
Low-privileged network-based attackers can extract restricted notification data through the Echo API endpoint, potentially aiding reconnaissance against wiki users and administrators.
Affected Products
- Wikimedia Foundation Echo extension versions before 1.43.7
- Wikimedia Foundation Echo extension versions before 1.44.4
- Wikimedia Foundation Echo extension versions before 1.45.2
Discovery Timeline
- 2026-05-11 - CVE-2026-5266 published to NVD
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2026-5266
Vulnerability Analysis
The Echo extension provides notification handling for MediaWiki, alerting users about edits, mentions, and other activity. CVE-2026-5266 is rooted in includes/Api/ApiEchoNotifications.Php, the API module responsible for returning notification data to clients. The module fails to fully constrain what notification metadata is returned to a requesting actor. As a result, an authenticated user with minimal privileges can issue API requests and receive information about notifications that should be restricted. The exposure is limited to confidentiality, with no impact on integrity or availability of the wiki platform. The EPSS score is 0.047% with a percentile of 14.5, indicating low expected exploitation probability.
Root Cause
The root cause is insufficient access control checks in the ApiEchoNotifications API handler. The module returns notification objects without filtering or masking fields that should be visible only to privileged roles. This is a classic [CWE-200] pattern where API responses include more data than the requesting actor is authorized to see.
Attack Vector
Exploitation requires network access to the MediaWiki instance and a low-privileged authenticated account. The attacker invokes the Echo notifications API endpoint and parses the response for fields that disclose unauthorized data. User interaction is not required. The vulnerability does not allow modification of wiki content or denial of service.
No public proof-of-concept code is available. Refer to the Wikimedia Task T420154 tracker for technical context.
Detection Methods for CVE-2026-5266
Indicators of Compromise
- Unusual volume of requests to MediaWiki API endpoints invoking the echonotifications module from a single authenticated session.
- Requests to api.php?action=query&meta=notifications with non-standard parameter combinations or repeated pagination.
- API access patterns from accounts that do not normally consume notification data programmatically.
Detection Strategies
- Inspect MediaWiki access logs for ApiEchoNotifications invocations correlated with low-privileged user accounts.
- Compare current Echo extension versions across MediaWiki deployments against fixed releases 1.43.7, 1.44.4, and 1.45.2.
- Alert on API responses returning notification fields to user roles that historically did not access them.
Monitoring Recommendations
- Forward MediaWiki API request and response logs to a centralized logging platform for behavioral analysis.
- Establish a baseline for notification API usage per account role and alert on deviations.
- Track Echo extension version inventory continuously to detect outdated installations.
How to Mitigate CVE-2026-5266
Immediate Actions Required
- Upgrade the Echo extension to version 1.43.7, 1.44.4, or 1.45.2 depending on the MediaWiki branch in use.
- Audit recent API access logs for unauthorized notification queries from low-privileged accounts.
- Rotate API tokens or session credentials for accounts suspected of probing the notifications endpoint.
Patch Information
Wikimedia Foundation has addressed the issue in Echo releases 1.43.7, 1.44.4, and 1.45.2. The fix updates the access control logic in includes/Api/ApiEchoNotifications.Php to prevent unauthorized exposure of notification data. Administrators should consult the Wikimedia Task T420154 reference for patch details and apply the appropriate fixed version.
Workarounds
- Restrict access to the MediaWiki API at the web server or reverse proxy layer, allowing only trusted networks where feasible.
- Disable or remove the Echo extension on wikis that do not require notification functionality until patching is complete.
- Enforce stricter user group permissions to reduce the number of low-privileged accounts capable of invoking the API.
# Example: verify installed Echo extension version on a MediaWiki server
grep -R "'version'" extensions/Echo/extension.json
# Example: restrict API access via Apache configuration
<Location "/w/api.php">
Require ip 10.0.0.0/8
Require ip 192.168.0.0/16
</Location>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
