MediaWiki CVE-2026-34088

User interaction is mandatory (UI:P in CVSS vector) - the vulnerability does not trigger automatically on page load or unauthenticated access alone. An attacker must perform a specific user action to cause information disclosure; the exact nature of this action is not detailed in the available CVE description but is documented in the Phabricator ticket. The vulnerability affects default MediaWiki installations without requiring non-standard configuration. The vulnerability is remote and requires no authentication (PR:N), meaning any visitor to the site can attempt exploitation if they know or discover the triggering action. Exploitation is limited to confidentiality impact with no ability to modify or delete data, nor to degrade service availability.

Despite the extremely low CVSS score of 1.3, this vulnerability warrants careful assessment rather than dismissal. The score reflects limited confidentiality impact and mandatory user interaction, which substantially reduce real-world exploitability. The CVSS vector shows no active exploitation rating (E:U) and remediation level is moderate (RE:M), suggesting this is not a zero-day emergency. However, the network-accessible attack vector (AV:N) with no authentication (PR:N) means any visitor to a MediaWiki instance could potentially trigger the disclosure if they perform specific user-driven actions. The actual risk depends entirely on: (1) what specific sensitive information is exposed, (2) how obvious or discoverable the triggering user action is, and (3) whether the user action is plausible in normal site usage. CVSS 1.3 likely reflects vendor judgment that exposure is narrow and user action requirement is high friction. No EPSS score, KEV status, or POC data provided - assume limited real-world exploitation pressure. Priority should be normal patching cadence rather than emergency response.

An attacker visits a MediaWiki instance and performs a specific user-driven action that triggers the information disclosure vulnerability. For example, they may interact with a particular feature, access a crafted URL, or submit form data in an unexpected way that causes the site to inadvertently reveal sensitive information (such as internal configuration, user session tokens, or admin-only data) in the response. The attacker does not need to authenticate but must deliberately perform the triggering action - this is not a passive vulnerability affecting all page views. No public exploit code or proof of concept has been identified.