CVE-2026-58518 Overview
CVE-2026-58518 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Wikimedia Foundation MediaWiki RedirectManager Extension. The flaw exists in all versions before 1.3.3 and is tracked under CWE-352. Attackers can craft malicious web content that causes an authenticated MediaWiki user's browser to submit unauthorized state-changing requests to the RedirectManager Extension. The vulnerability requires no privileges and no user interaction beyond visiting an attacker-controlled page.
Critical Impact
An attacker can trick authenticated wiki administrators or editors into performing unintended redirect management operations, enabling manipulation of wiki redirects and potential content integrity issues.
Affected Products
- Wikimedia Foundation MediaWiki RedirectManager Extension versions prior to 1.3.3
- MediaWiki installations with the RedirectManager Extension enabled
- Any wiki deployment using vulnerable RedirectManager Extension builds
Discovery Timeline
- 2026-07-01 - CVE-2026-58518 published to NVD
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-58518
Vulnerability Analysis
The RedirectManager Extension for MediaWiki fails to validate the origin of state-changing HTTP requests. When an authenticated user visits an attacker-controlled page, that page can issue requests to the target wiki using the victim's session cookies. The extension processes these requests as legitimate, permitting unauthorized changes to redirect configurations.
CSRF vulnerabilities in wiki extensions are particularly relevant because authenticated wiki administrators frequently maintain long-lived sessions. The attack vector is remote, requires no authentication on the attacker's side, and no user interaction beyond browsing.
Root Cause
The vulnerability stems from missing or insufficient CSRF token validation on request handlers within the RedirectManager Extension. MediaWiki provides an edit token mechanism to prevent CSRF, but the affected code paths in the extension did not enforce this check for sensitive operations. Details of the fix are documented in the Wikimedia Gerrit commit and Phabricator task T423826.
Attack Vector
An attacker hosts a malicious webpage containing a hidden form or JavaScript that targets the vulnerable RedirectManager endpoint. When an authenticated wiki user visits the page, the browser submits the forged request using the user's session credentials. The extension processes the request without verifying that it originated from a legitimate wiki page, resulting in unauthorized redirect changes.
No exploitation code example is available. Refer to the Wikimedia Phabricator task T423826 and the associated Gerrit patch for technical remediation details.
Detection Methods for CVE-2026-58518
Indicators of Compromise
- Unexpected redirect modifications in MediaWiki audit logs without corresponding administrator activity in the standard workflow
- HTTP Referer headers on RedirectManager requests originating from external, non-wiki domains
- Redirect creation or modification requests submitted without a valid MediaWiki edit token parameter
Detection Strategies
- Review MediaWiki logs for RedirectManager Extension actions and correlate with user session activity and originating referrers
- Enable detailed request logging on the web server hosting MediaWiki to capture full request metadata for RedirectManager endpoints
- Alert on RedirectManager state changes made outside expected administrator working hours or from unusual IP ranges
Monitoring Recommendations
- Monitor the installed RedirectManager Extension version and flag any deployment running a release earlier than 1.3.3
- Track anomalous spikes in redirect creation, modification, or deletion events per user account
- Aggregate MediaWiki access logs into a central log platform for correlation with browser-based user activity
How to Mitigate CVE-2026-58518
Immediate Actions Required
- Upgrade the MediaWiki RedirectManager Extension to version 1.3.3 or later across all affected wiki instances
- Audit recent redirect changes for unauthorized or suspicious modifications and revert as needed
- Enforce short session lifetimes for administrative wiki accounts to reduce CSRF exposure windows
Patch Information
The Wikimedia Foundation resolved this issue in RedirectManager Extension version 1.3.3. The upstream fix is available in the Wikimedia Gerrit commit and tracked in Phabricator task T423826. Administrators should apply the update using standard MediaWiki extension management procedures.
Workarounds
- Disable the RedirectManager Extension until the patched version can be installed if immediate upgrade is not possible
- Restrict access to the wiki's administrative interfaces to trusted IP ranges via web server access controls
- Instruct administrators to log out of the wiki before browsing untrusted sites and to use separate browser profiles for wiki administration
# Configuration example - upgrade the RedirectManager Extension
cd /path/to/mediawiki/extensions/RedirectManager
git fetch --tags
git checkout 1.3.3
php /path/to/mediawiki/maintenance/update.php
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
