MediaWiki PageTriage CVE-2026-103440

Exploitation requires an authenticated account on a MediaWiki instance running the PageTriage extension (PR:L), plus a specific precondition to be present (AT:P) and passive user interaction (UI:P) - it is not a default-configuration, unauthenticated attack. The affected feature is PageTriage's data-query/listing interface, where CWE-202 information exposure through queries lets a low-privileged actor elicit restricted data. Limiting factors: only versions 1.43, 1.45, and 1.46 are affected; PageTriage is an optional extension not enabled on most MediaWiki installs; and the impact is confined to minor confidentiality disclosure with no integrity or availability effect.

This is a low-priority issue that does not warrant urgent action. The vendor-supplied CVSS 4.0 base score is only 1.2, driven by requirements that materially limit exploitation: PR:L (an authenticated account is required), AT:P (a specific attack requirement/precondition must be present), UI:P (passive user interaction), and only Low impact across confidentiality, integrity and availability. The CWE-202 classification (Exposure of Sensitive Information Through Data Queries) and the 'Information Elicitation' phrasing indicate an authenticated actor can coax the PageTriage extension's query interfaces into returning data they should not see - an information-leak, not code execution or takeover. No EPSS score, no CISA KEV listing, and no public exploit were provided; the CVSS vector's E:P (Proof-of-Concept) exploit-maturity value hints a PoC concept may exist internally, but this is distinct from active exploitation and no exploit code was supplied in the intelligence. Signals are internally consistent (a low-severity authenticated info-leak in a niche extension); there is no conflict between the network attack vector and the authenticated, precondition-gated reality, so no priority inflation is warranted.

An authenticated user with a low-privilege account on a wiki running the PageTriage extension issues crafted queries against the extension's data/listing endpoints and, under the right conditions, elicits fragments of information that should be restricted (e.g., metadata about pages or users not exposed through the normal interface). No public exploit code was provided, and the CVSS E:P value suggests at most a proof-of-concept rather than a weaponized exploit. Impact is limited to minor confidentiality disclosure, requiring both an account and specific preconditions.