EUVD-2026-89071
GHSA-hm8p-x35f-6gwh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify MediaWiki host running EventBus extension
-
ExploitSend crafted unauthenticated request
-
ExecutionTrigger improper information exposure
-
ImpactHarvest leaked sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the target MediaWiki site to have the EventBus extension installed and enabled at the affected 1.47.0-alpha build - EventBus is NOT a default-bundled MediaWiki extension, so the condition is a deliberate deployment choice (common chiefly in Wikimedia-style event-driven production setups). Within that configuration the CVSS vector indicates no further prerequisites: no authentication (PR:N), no user interaction (UI:N), network-reachable (AV:N), low complexity (AC:L). The primary limiting factors are the non-default extension requirement and the fact that only a pre-release alpha version (1.47.0-alpha) is listed as affected, which bounds the realistic installed base; SSVC Technical Impact=partial further suggests the data exposed is partial rather than a full system compromise. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a remotely reachable, low-complexity, pre-authentication confidentiality-only flaw - consistent with CWE-200 (exposure of sensitive information). However, the real-world urgency signals are muted and partially conflicting. CISA's SSVC decision data lists Exploitation=none and Technical Impact=partial, which tempers the 'C:H' rating: the leak is real but bounded, not a total compromise. Automatable=yes means that once a method is known it could be scripted broadly, so the potential for opportunistic scanning exists. No CISA KEV listing and no public POC are present in the input, so this is 'no public exploit identified at time of analysis.' A key caveat: the only affected version is 1.47.0-alpha, a pre-release/alpha build of a non-default MediaWiki extension, which sharply narrows the production exposure despite the network-reachable, unauthenticated vector. Net assessment: medium-to-high paper severity but low near-term real risk - prioritize patching Wikimedia-infrastructure and event-driven MediaWiki deployments running the EventBus extension, but this is not an emergency for the broader MediaWiki population. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends crafted requests to a MediaWiki instance running the vulnerable EventBus extension (1.47.0-alpha) and receives back sensitive information that should not be exposed. Because the vector is AV:N/AC:L/PR:N/UI:N and SSVC marks it Automatable=yes, the request could be scripted against many hosts, though no public POC or active exploitation is reported at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Sensitive information disclosure in the MediaWiki EventBus extension (affected build 1.47.0-alpha) allows remote, unauthenticated attackers to read event data that should be restricted to authorized event consumers, scoring CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exposure is bounded by configuration and version: EventBus is not a default-bundled MediaWiki extension, so only sites that deliberately install and enable it are reachable, and only the pre-release 1.47.0-alpha branch is listed as affected, which sharply limits the realistic installed base. The independent assessment rates SSVC technical impact as partial rather than full system compromise, and no public exploit identified at time of analysis, although SSVC flags the issue as automatable and exploitation as 'none'.
RemediationAI
No vendor-released tagged patch version is confirmed in the provided data; the upstream fix appears as a Gerrit change (I6d79037edc771fe9a2889c543e12cf7b1296aab8, tracked in Phabricator T432948) - upstream fix available (PR/commit); released patched version not independently confirmed - so operators should apply that change to their 1.47.0-alpha deployment or move to the next release that contains it, referencing https://phabricator.wikimedia.org/T432948 and https://gerrit.wikimedia.org/r/q/I6d79037edc771fe9a2889c543e12cf7b1296aab8 for exact revisions. If patching cannot be completed promptly, the most effective compensating control is to disable the EventBus extension (wfLoadExtension removal or equivalent configuration) on any wiki that does not strictly require event streaming; the trade-off is loss of event publication to EventGate/Kafka, which breaks EventStreams, analytics, and any downstream consumers relying on those events. Where the extension must stay enabled, restrict network reachability to the event-ingestion path so that only trusted producer/consumer hosts can query it - for example by firewalling the EventGate endpoint and front-end proxies to known IP ranges and blocking the relevant request paths at the reverse proxy or WAF - accepting that this constrains legitimate integrators and may be bypassed for internal attackers already inside the trusted range. Also apply the standard monitoring response for an automatable, network-reachable disclosure: alert on anomalous or high-volume requests to EventBus-related endpoints, review event payloads for secrets that should never have been published, and rotate any credentials, tokens, or identifiers that may have been exposed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Wikimedia-developed EventBus extension for MediaWiki, which republishes internal MediaWiki events (page changes, account and revision activity, state transitions) to an external event stream, typically via Kafka and an EventGate endpoint, using the Event Platform libraries. The CWE-200 classification (exposure of sensitive information to an unauthorized actor) places the root cause in the information-exposure class rather than injection, deserialization, or memory corruption: the extension surfaces or publishes data without the access checks that should confine it to legitimate consumers. The CPE cpe:2.3:a:wikimedia_foundation:mediawiki_-_eventbus_extension:*:*:*:*:*:*:*:* confirms the affected package is the extension itself, with EUVD pinning the affected version to MediaWiki - EventBus Extension 1.47.0-alpha. The CVSS vector's PR:N and UI:N confirm the data can be pulled by any network-reachable client with no credentials and no victim interaction, and AC:L means no timing or race condition is required - consistent with the SSVC 'automatable: yes' rating, meaning the disclosure can be scripted and repeated at scale once a target is fingerprinted. Scope is unchanged (S:U) and there is no integrity or availability impact (I:N/A:N), so a successful attack degrades confidentiality only.
Know when Mediawiki Eventbus Extension gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable, low-complexity, unauthenticated information exposure (CWE-200) with no integrity or availability impact; confidentiality rated high per vendor, though SSVC 'partial' hints it may be lower.
Primary rating from Vendor (wikimedia-foundation).
CVSS VectorVendor: wikimedia-foundation
Lifecycle Timeline
3DescriptionCVE.org
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - EventBus Extension allows Excavation.
This issue affects Mediawiki - EventBus Extension: 1.47.0-alpha.
Executive ViewAI
MediaWiki EventBus 1.47.0-alpha, a non-default extension, can expose restricted event data to remote unauthenticated readers; only organizations that deliberately installed and enabled this pre-release build are affected. Because no public exploit has been identified and exposure is configuration-bound, this is not a broad enterprise risk, but affected teams should treat it as a confidential-data disclosure issue pending a vendor fix. Leadership should confirm whether any business unit runs this extension and, if so, prioritize containment while awaiting a patch.
No vendor-released patch identified at time of analysis. Interim mitigations: disable or remove the EventBus extension on MediaWiki 1.47.0-alpha; if it must remain enabled, restrict event/consumer endpoints to authorized IPs or authenticated reverse-proxy access, segment the affected MediaWiki deployment, monitor logs for anomalous event-data reads, and roll back to a supported stable EventBus/MediaWiki version if operationally feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB