Is there a patch available for CVE-2026-34093?

Yes, a patch is available for CVE-2026-34093. Update the affected software to the latest version immediately.

MediaWiki CVE-2026-34093

Q: What is the CVSS score of CVE-2026-34093?

CVE-2026-34093 has a CVSS 4.0 base score of 1.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:A/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29107 LOW

Information Exposure (CWE-200)

2026-05-11 wikimedia-foundation

GHSA-34wc-vx7r-829j

PHP Information Disclosure Mediawiki Wikimedia Foundation

1.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:A/V:X/RE:X/U:X

vuln.today AI

3.5 LOW

Network-accessible, low-complexity flaw requiring a low-privilege authenticated session and explicit user interaction; only low confidentiality impact with no integrity or availability consequences.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 23:59 vuln.today

Patch available

May 11, 2026 - 18:02 EUVD

CVE Published

May 11, 2026 - 16:48 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.

This vulnerability is associated with program files includes/Specials/SpecialUserRights.Php.

This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

AnalysisAI

MediaWiki's SpecialUserRights.php exposes sensitive information to authenticated low-privilege users across versions prior to 1.43.7, 1.44.4, and 1.45.2. The vulnerability resides in the user rights management special page, where insufficient access controls allow a logged-in actor with minimal privileges to read confidential data - likely user group memberships, rights assignments, or related administrative details - that should be restricted to privileged operators. No public exploit exists and SSVC rates exploitation as none, placing this firmly in low-urgency patch territory despite its network-accessible attack vector.

Technical ContextAI

MediaWiki is the PHP-based wiki platform powering Wikipedia and thousands of institutional wikis. The affected code path is includes/Specials/SpecialUserRights.php - the server-side handler for the Special:UserRights page, which MediaWiki uses to manage group memberships and permission assignments for wiki accounts. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) indicates the root cause is an access control gap: the page does not properly gate display of certain sensitive data based on the viewer's privilege level. The CPE cpe:2.3:a:wikimedia_foundation:mediawiki:* covers all pre-fix releases across the three active release branches (1.43.x, 1.44.x, 1.45.x). The CVSS 4.0 vector's PR:L confirms exploitation requires an authenticated, low-privilege wiki account, and UI:A indicates some form of user interaction or page navigation is necessary to trigger the information leak.

RemediationAI

The primary fix is upgrading to MediaWiki 1.43.7, 1.44.4, or 1.45.2, whichever corresponds to the deployed release branch - all three are confirmed patched by the vendor. Administrators should consult the Wikimedia Phabricator task at https://phabricator.wikimedia.org/T414547 for patch notes and upgrade instructions. If an immediate upgrade is not feasible, a targeted workaround is to restrict access to the Special:UserRights page using MediaWiki's built-in permission system by setting $wgGroupPermissions appropriately to limit which groups can view or interact with the page - this reduces the exposed surface at the cost of potentially restricting legitimate administrative workflows. Blocking unauthenticated or low-privilege users from the Special:UserRights namespace via a reverse proxy ACL (e.g., Nginx location block requiring higher-trust session attributes) is a secondary option, though it introduces operational complexity and may interfere with legitimate use cases.