Is there a patch available for CVE-2026-5266?

Yes, a patch is available for CVE-2026-5266. Update the affected software to the latest version immediately.

Wikimedia Echo CVE-2026-5266

Q: What is the CVSS score of CVE-2026-5266?

CVE-2026-5266 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29157 LOW

Information Exposure (CWE-200)

2026-05-11 wikimedia-foundation

GHSA-vmww-wfjj-w6p8

Information Disclosure PHP Echo

2.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.1 LOW

AT:P maps to AC:H; PR:L reflects required authenticated session; C:L and no I/A impact per CVSS 4.0 source vector.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 23:58 vuln.today

Patch available

May 11, 2026 - 18:17 EUVD

CVE Published

May 11, 2026 - 16:55 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Echo.

This vulnerability is associated with program files includes/Api/ApiEchoNotifications.Php.

This issue affects Echo: from * before 1.43.7, 1.44.4, 1.45.2.

AnalysisAI

Sensitive notification data is exposed to authenticated but unauthorized actors through the Echo extension's API layer in MediaWiki. The vulnerability resides in includes/Api/ApiEchoNotifications.php, where insufficient access control on the notifications API allows a low-privileged authenticated user - under specific attack conditions (AT:P) - to retrieve notification content belonging to other users or restricted contexts. No active exploitation has been identified (SSVC: Exploitation none; EPSS 0.04%, 13th percentile), and the vendor has released patched versions across all supported branches.

Technical ContextAI

Wikimedia Echo is a MediaWiki extension providing the on-wiki notification system (alerts and messages). The affected code path is the API handler at includes/Api/ApiEchoNotifications.php, which exposes notification data over MediaWiki's Action API. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) indicates the root cause is a missing or insufficient authorization check - the API responds to valid authenticated requests without properly verifying the requester's entitlement to the queried notification objects. The CVSS 4.0 vector includes AT:P (Attack Requirements: Present), indicating that exploitation is not fully generic; a specific attack condition or configuration state must be present. CPE confirms the affected product as cpe:2.3:a:wikimedia_foundation:echo:*:*:*:*:*:*:*:*, covering all versions prior to the patched releases. The vulnerability is confined to the PHP backend; no integrity or availability impact is present (VI:N, VA:N, SI:N, SA:N).

RemediationAI

Operators running MediaWiki with the Echo extension should upgrade to the patched release corresponding to their active branch: 1.43.7 or later for the 1.43.x line, 1.44.4 or later for the 1.44.x line, or 1.45.2 or later for the 1.45.x line. The vendor has confirmed patch availability; the Phabricator task at https://phabricator.wikimedia.org/T420154 should be consulted for release details. If an immediate upgrade is not feasible, a pragmatic compensating control is to restrict access to the MediaWiki Action API (api.php) to authenticated sessions only at the web server or firewall layer - this does not eliminate the vulnerability but raises the bar by ensuring unauthenticated actors cannot probe the endpoint. Note that blocking API access entirely will disable legitimate functionality such as bots, gadgets, and third-party integrations, so this workaround carries significant operational trade-offs and is unsuitable for public wikis.