CVE-2026-58028 Overview
CVE-2026-58028 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting Wikimedia Foundation MediaWiki and the CentralAuth extension. The flaw stems from improper neutralization of input during web page generation across multiple core components. Authenticated attackers with low privileges can inject script content that executes in the browsers of other users viewing affected pages. The vulnerability affects MediaWiki and CentralAuth versions prior to 1.46.0, 1.45.4, 1.44.6, and 1.43.9.
Critical Impact
Authenticated attackers can inject arbitrary JavaScript into MediaWiki-rendered pages, enabling session theft, account takeover, and defacement across wiki installations including federated CentralAuth deployments.
Affected Products
- Wikimedia Foundation MediaWiki versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9
- Wikimedia Foundation CentralAuth extension versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9
- MediaWiki installations using the affected API, ResourceLoader, and LogFormatter components
Discovery Timeline
- 2026-07-01 - CVE-2026-58028 published to NVD
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-58028
Vulnerability Analysis
The vulnerability resides in multiple MediaWiki PHP source files that handle user-supplied content during web page generation. Affected files include includes/Api/ApiFormatBase.php, includes/Api/ApiHelp.php, includes/ResourceLoader/Module.php, includes/Hooks/Handlers/PageDisplayHookHandler.php, and includes/LogFormatter/PermissionChangeLogFormatter.php. Each component failed to properly encode or sanitize input before rendering it into HTML output.
The flaw is classified as Cross-Site Scripting (XSS) under [CWE-79]. Because the vulnerable code paths span API output formatting, resource loading, page display hooks, and log formatting, exploitation surfaces exist across normal browsing, API interaction, and administrative log viewing contexts.
Root Cause
The root cause is improper neutralization of input during web page generation. The affected PHP files reflected user-controllable data into HTML contexts without applying appropriate output encoding. When rendered by a victim's browser, injected markup executes within the trust context of the wiki origin. CentralAuth's cross-wiki session model amplifies the impact because a single successful injection can affect users authenticated across federated wikis.
Attack Vector
An authenticated attacker with low privileges submits crafted input through interfaces served by the vulnerable components. The payload is later rendered without adequate escaping when other users view API help pages, permission change logs, resource loader responses, or hook-driven page displays. Execution occurs in the victim's browser session, enabling cookie theft, CSRF token exfiltration, and forced actions performed as the victim.
No verified public proof-of-concept code is available for this issue. Refer to the Wikimedia Phabricator Task for technical details.
Detection Methods for CVE-2026-58028
Indicators of Compromise
- Unexpected <script> tags or JavaScript event handlers appearing in rendered API help output, permission change logs, or ResourceLoader module responses
- Log entries showing edits or API submissions containing encoded HTML payloads followed by anomalous session activity
- Outbound HTTP requests from user browsers to unfamiliar domains immediately after loading wiki pages
Detection Strategies
- Review web server access logs for requests to api.php and load.php endpoints containing HTML entities, angle brackets, or JavaScript keywords in parameters
- Audit MediaWiki edit history and log tables for permission change entries with suspicious formatting or embedded markup
- Deploy Content Security Policy (CSP) violation reporting to surface script injection attempts against the wiki origin
Monitoring Recommendations
- Monitor authentication logs for session anomalies such as concurrent logins from unrelated geolocations, particularly on CentralAuth-federated wikis
- Alert on privileged account activity that follows the viewing of user-generated content or log pages
- Track ResourceLoader module load patterns for unexpected module names or parameters not aligned with deployed extensions
How to Mitigate CVE-2026-58028
Immediate Actions Required
- Upgrade MediaWiki and CentralAuth to version 1.46.0, 1.45.4, 1.44.6, or 1.43.9 depending on your release branch
- Invalidate active user sessions after patching to terminate any sessions potentially compromised prior to remediation
- Review recent permission change logs and administrative actions for signs of unauthorized use
Patch Information
Wikimedia Foundation has released fixed versions across four supported branches. Administrators should apply the update matching their current major version: 1.46.0 for the latest branch, 1.45.4, 1.44.6, or 1.43.9 for long-term support branches. Consult the Wikimedia Phabricator Task for patch commits and technical remediation details.
Workarounds
- Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
- Restrict account creation and reduce the pool of low-privilege accounts able to submit content until patches are applied
- Disable or restrict access to affected API endpoints and log views for untrusted users where operationally feasible
# Example: apply upgrade via git for a MediaWiki 1.43 branch installation
cd /var/www/mediawiki
git fetch origin
git checkout 1.43.9
php maintenance/update.php --quick
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
