MediaWiki CVE-2026-34094

Exploitation requires a highly privileged MediaWiki account (PR:H per the CVSS 4.0 vector - equivalent to administrator or bureaucrat level), high attack complexity (AC:H), the presence of specific attack preconditions (AT:P, meaning a non-default or uncommon configuration or wiki state must exist), and passive user interaction (UI:P). The vulnerability is confined to the article page rendering path in includes/Page/Article.php and results only in low confidentiality disclosure (VC:L) with no impact on integrity or availability. Unauthenticated users and low-privileged editors cannot exploit this issue. The AT:P condition specifically limits exploitation to scenarios where particular wiki configuration states or content conditions are met, substantially restricting the realistic attacker population beyond what the network attack vector alone would suggest.

All available risk signals consistently indicate low real-world risk. The CVSS 4.0 base score of 2.0 reflects a vulnerability that requires high privileges (PR:H), high attack complexity (AC:H), specific attack preconditions (AT:P), and passive user interaction (UI:P), yielding only a low confidentiality impact with no integrity or availability consequence (VI:N, VA:N). EPSS at 0.04% places this in the 12th percentile - exploitation is statistically very unlikely relative to other known vulnerabilities. SSVC confirms exploitation status as 'none,' the vulnerability is not automatable, and technical impact is only partial. There is no CISA KEV listing and no known public exploit or POC. The sole signal that elevates any concern is the network attack vector (AV:N), but this is heavily offset by every other metric. There are no conflicting signals here - this is a genuine low-priority finding with no urgency beyond routine patch hygiene.

A highly privileged MediaWiki user - such as an administrator or bureaucrat - under specific and uncommon preconditions triggers an article page load via includes/Page/Article.php that inadvertently returns limited confidential content outside its intended authorization boundary. No public proof-of-concept exploit exists, and the attacker would need prior knowledge of the exact preconditions (AT:P) and a high-privilege account, making opportunistic exploitation implausible.