CVE-2026-96879: MediaWiki FlaggedRevs Information Disclosure

CVE-2026-96879 Overview

CVE-2026-96879 is an information disclosure vulnerability in the Wikimedia Foundation's MediaWiki FlaggedRevs extension through version 1.46.0. The flaw stems from improper removal of sensitive information before storage or transfer, classified under [CWE-212]. Unauthenticated attackers can exploit the issue remotely over the network without user interaction. The vulnerability affects confidentiality of both the vulnerable component and subsequent systems, though integrity and availability remain intact. FlaggedRevs is a widely deployed MediaWiki extension used by Wikipedia and other wikis to manage reviewed revisions of pages.

Critical Impact

Remote, unauthenticated attackers can access sensitive information that should have been sanitized before storage or transfer by the FlaggedRevs extension.

Affected Products

• Wikimedia Foundation MediaWiki FlaggedRevs extension through version 1.46.0
• MediaWiki installations using FlaggedRevs for revision review workflows
• Downstream wikis bundling vulnerable FlaggedRevs releases

Discovery Timeline

• 2026-09-25 - CVE-2026-96879 published to the National Vulnerability Database
• 2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-96879

Vulnerability Analysis

The FlaggedRevs extension fails to properly strip sensitive information before data is stored or transmitted. This maps to [CWE-212] (Improper Removal of Sensitive Information Before Storage or Transfer). The exposed data crosses a trust boundary, meaning information intended to remain internal becomes reachable by unauthenticated remote users. Because exploitation requires no privileges and no user interaction, scanning-based discovery is straightforward for an attacker who identifies a vulnerable wiki.

Root Cause

The root cause is a sanitization gap in FlaggedRevs code paths that handle revision metadata before it is persisted or returned to clients. Fields that should be redacted, filtered, or scoped to privileged roles are instead included in output accessible to any requester. The upstream fix is tracked in Wikimedia Gerrit change 1344737 and Phabricator task T433020.

Attack Vector

Exploitation occurs over the network against any MediaWiki instance running FlaggedRevs at or below version 1.46.0. An attacker issues standard HTTP requests to endpoints exposed by the extension and parses the response for information that should have been filtered. No authentication, no user interaction, and no elevated privileges are required. Refer to the linked Wikimedia references for technical specifics on the affected code paths.

Detection Methods for CVE-2026-96879

Indicators of Compromise

• Unusual volumes of unauthenticated requests to FlaggedRevs-related API modules or special pages
• Repeated requests from a single source enumerating revisions, review logs, or flagged page metadata
• Access patterns that scrape revision history or review state across many pages in short time windows

Detection Strategies

• Review MediaWiki access logs for anonymous requests targeting FlaggedRevs endpoints and compare response sizes against baseline
• Deploy web application firewall rules that flag unauthenticated enumeration of review metadata
• Correlate HTTP 200 responses on FlaggedRevs API calls with client fingerprints associated with scraping tools

Monitoring Recommendations

• Centralize MediaWiki and reverse-proxy logs in a SIEM to establish request baselines per endpoint
• Alert on spikes in FlaggedRevs API usage from non-logged-in sessions or non-browser user agents
• Track outbound data volumes from the wiki host to detect bulk extraction of exposed fields

How to Mitigate CVE-2026-96879

Immediate Actions Required

• Inventory all MediaWiki installations and identify those running the FlaggedRevs extension at version 1.46.0 or earlier
• Apply the upstream fix referenced in Wikimedia Gerrit change 1344737 once a tagged release is available
• Restrict anonymous access to FlaggedRevs API modules while patching is scheduled

Patch Information

The remediation is tracked in Wikimedia Phabricator task T433020 with the code change staged in Gerrit. Administrators should pull the fixed FlaggedRevs release from the official MediaWiki extension distribution channel and redeploy. Verify extension version after upgrade via Special:Version.

Workarounds

• Temporarily disable the FlaggedRevs extension on sites that do not require review workflows
• Place a reverse proxy or WAF rule in front of MediaWiki to block unauthenticated calls to FlaggedRevs API endpoints
• Rate-limit anonymous requests to reduce bulk extraction while a patch is being staged

# Example: disable FlaggedRevs in LocalSettings.php until patched
# Comment out the extension load line, then clear the cache
# wfLoadExtension( 'FlaggedRevs' );
php maintenance/update.php --quick