MediaWiki CentralAuth CVE-2026-100244

Requires the target MediaWiki installation to have the CentralAuth extension deployed - the extension used for global/shared accounts across a wiki farm (as on Wikimedia projects) - at a version before 1.46.1, 1.45.5, or 1.43.10. Given AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no special non-default configuration beyond having the extension enabled are needed; exploitation is remote against the extension's default behavior. The principal limiting factor is the narrow deployment footprint: only wikis running CentralAuth (multi-wiki SSO setups) are affected, not standalone MediaWiki instances without this extension. Impact is confined to confidentiality (information disclosure); no integrity or availability effect.

This is a genuine but moderate-priority issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5) indicates remote, unauthenticated, low-complexity exploitation with high confidentiality impact but no integrity or availability impact - consistent with CWE-200 information exposure. CISA's SSVC framework reinforces a measured view: Exploitation status is 'none' (no observed or public exploitation), Automatable is 'yes' (the disclosure can likely be scripted/scraped at scale), and Technical Impact is 'partial' (data exposure, not full system control). No EPSS score was supplied in the input, there is no CISA KEV listing, and no public exploit code was identified, so all three exploitation signals currently point to no active exploitation. The combination 'Automatable: yes' but 'Exploitation: none' suggests the flaw would be easy to weaponize if an exploit emerged, which argues for prompt patching even absent current in-the-wild activity. Note a minor consistency check: the 7.5 base score with C:H/I:N/A:N is internally coherent, but the precise nature of what sensitive data is exposed is not detailed in the description - verify scope (e.g., account/session/global-user data) against the Phabricator/Gerrit references before finalizing impact triage.

A remote, unauthenticated attacker sends crafted requests to a wiki running the CentralAuth extension (multi-wiki single-sign-on) and retrieves sensitive information that should not be exposed to unauthorized actors. Because the flaw is network-reachable, requires no privileges or user interaction, and is marked Automatable by SSVC, an attacker could script bulk collection across many accounts or wikis. No public exploit code was identified at time of analysis.