Wikimedia AbuseFilter CVE-2026-34086

Exploitation requires authentication (PR:L, low-privilege account or above), active user interaction (UI:P), high attack complexity (AC:H), and partial temporal occurrence (AT:P) suggesting the issue manifests under specific timing, configuration, or environmental conditions. The vulnerability does not affect default deployments without user action - an attacker must have a valid low-privilege account and must actively engage with AbuseFilter features through the network interface to trigger the disclosure.

Real-world risk is low despite the vulnerability being publicly documented. CVSS score of 2.1 is at the absolute minimum severity threshold, reflecting multiple limiting factors: required authentication (PR:L), user interaction (UI:P), and attack complexity high (AC:H) with partial temporal occurrence (AT:P). EPSS score and KEV status are not available, but the information disclosure classification and low-privilege requirement suggest this is not a priority for widespread exploitation. The impact is limited to confidentiality (VI:L/VC:L) with no integrity or availability impact, and scope is not changed, indicating the attacker cannot escalate beyond their existing permissions. This appears to be a legitimate but low-impact vulnerability affecting authenticated users who must perform specific interactions to trigger the leak.

An authenticated user with low-privilege access logs into a Wikimedia installation running vulnerable AbuseFilter and performs specific interactions with filter configuration or execution logic, causing the system to expose limited confidential information related to filter rules or internal processing. The interaction may involve crafted inputs to filter form fields or deliberate sequencing of filter operations that triggers the information disclosure.