Wikimedia Echo CVE-2026-5266

Exploitation requires a valid authenticated session on the target MediaWiki installation (PR:L - low-privileged account, e.g., a standard registered wiki user). Additionally, the CVSS 4.0 AT:P metric indicates that specific attack requirements must be present beyond standard authentication - likely a particular API parameter combination, the presence of notification data in a cross-accessible state, or a specific wiki configuration. The SSVC 'Automatable: no' rating confirms that exploitation cannot be scripted and mass-delivered without these preconditions. What limits exploitation: the requirement for a valid authenticated session excludes anonymous visitors; the AT:P condition excludes generic unauthenticated or default-configuration attacks; confidentiality impact is low (VC:L), meaning even a successful exploit yields limited sensitive data; and there is zero integrity or availability impact, ruling out data modification or denial of service.

All available signals converge on very low real-world risk. The CVSS 4.0 score is 2.3, driven by the combination of low confidentiality impact (VC:L), no integrity or availability impact, and the AT:P attack requirement that constrains exploitability. EPSS at 0.04% (13th percentile) confirms that the vulnerability is statistically unlikely to be exploited in the near term. CISA KEV status is absent, SSVC classifies exploitation as none and automatable as no, meaning mass exploitation is not feasible. Technical impact is rated partial (SSVC). No public exploit or proof-of-concept code has been identified. The only meaningful risk factor is that the attack vector is network-accessible and requires only low-level authentication, meaning any logged-in wiki user could potentially trigger the condition - but the AT:P requirement and low confidentiality scope narrow the realistic impact significantly. This vulnerability is a low-priority patching item for most operators, appropriate for inclusion in a regular maintenance cycle rather than emergency response.

An authenticated MediaWiki user with a standard (non-privileged) account sends a crafted API request to api.php targeting the Echo notifications endpoint with parameters referencing another user's notification context. Under the specific attack conditions required (AT:P), the API returns notification metadata or content that the requesting user should not have access to, disclosing potentially sensitive information such as notification messages, mentioned usernames, or page references. No public exploit code exists at the time of analysis, and the AT:P constraint means casual or automated exploitation is unlikely without prior knowledge of the triggering condition.