CVE-2026-34093

Vulnerability

Overview CVE-2026-34093 describes an information exposure vulnerability in MediaWiki's SpecialUserRights page. The flaw exists in the file includes/Specials/SpecialUserRights.php, which improperly handles access controls, allowing an unauthorized actor to obtain sensitive information [1].

Exploitation

An attacker with network access to the MediaWiki instance can exploit this by crafting a request to the SpecialUserRights endpoint. No authentication is required, but the attacker must be able to send HTTP requests to the vulnerable page. The vulnerability is classified as medium severity with a CVSS v3 score of 5.3, indicating relatively easy exploitation [1].

Impact

Successful exploitation leads to the exposure of sensitive information, which may include user rights details or other internal data. This information could aid further attacks or violate user privacy.

Mitigation

The Wikimedia Foundation has released patches in MediaWiki versions 1.43.7, 1.44.4, and 1.45.2. Users are advised to upgrade to these or later versions to remediate the issue. No workarounds are documented.