MediaWiki CVE-2026-34093

Exploitation requires an active, authenticated MediaWiki account with low-level privileges (PR:L) - anonymous/unauthenticated visitors cannot trigger the leak. The vulnerability is specifically gated on interaction with the Special:UserRights page (includes/Specials/SpecialUserRights.php), meaning the target user must navigate to or actively use that page (UI:A). Wikis that restrict Special:UserRights access exclusively to high-privilege groups via $wgGroupPermissions would effectively mitigate exposure for non-privileged users. The information impact is limited to confidentiality only (VC:L); there is no write or destructive capability associated with this flaw. Exploitation is not automatable per SSVC assessment.

Real-world risk is minimal across all available signals. The CVSS 4.0 base score of 1.1 reflects the combination of low-privilege authentication requirement (PR:L), mandatory user interaction (UI:A), and only low confidentiality impact (VC:L) with no integrity or availability consequences. EPSS is 0.04% at the 13th percentile, indicating the security community broadly does not anticipate near-term exploitation. SSVC concurs: exploitation status is none, it is not automatable (due to UI:A and PR:L), and technical impact is only partial. The E:U modifier in the 4.0 vector explicitly marks exploit maturity as unreported. No KEV listing and no public POC further confirm this has not attracted attacker attention. The primary real-world concern is that wikis exposing administrative user rights data could inadvertently reveal organizational structure or privilege hierarchies, which is a reconnaissance risk rather than a direct exploitation risk. Patch velocity should align with normal maintenance cycles rather than emergency response.

An authenticated MediaWiki user with a standard (low-privilege) account navigates to or is directed to the Special:UserRights page and, through normal page interaction, is presented with sensitive administrative data - such as group membership details or user rights assignments - that should only be visible to privileged administrators. No public exploit code exists for this scenario, and the interaction requirement (UI:A) means passive network observation alone is insufficient.