Is there a patch available for CVE-2026-58024?

Yes, a patch is available for CVE-2026-58024. Update the affected software to the latest version immediately.

MediaWiki CVE-2026-58024

Q: What is the CVSS score of CVE-2026-58024?

CVE-2026-58024 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-41034 MEDIUM

Information Exposure (CWE-200)

2026-07-01 wikimedia-foundation

GHSA-5mf7-4fq5-g3gp

PHP Information Disclosure Mediawiki Wikimedia Foundation

5.1

CVSS 4.0 · Vendor: wikimedia-foundation

Severity by source

Vendor (wikimedia-foundation) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.5 LOW

Network-accessible API endpoint, authenticated low-privilege user required (PR:L), passive interaction dependency maps to UI:R, confidentiality impact is low with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (wikimedia-foundation).

CVSS VectorVendor: wikimedia-foundation

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 01, 2026 - 17:01 EUVD

Analysis Generated

Jul 01, 2026 - 16:05 vuln.today

DescriptionCVE.org

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.

This vulnerability is associated with program files includes/Api/ApiUserrights.Php.

This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

AnalysisAI

Information disclosure in MediaWiki's ApiUserrights.php exposes sensitive user rights data to authenticated actors who should not have access to it. All MediaWiki installations running versions prior to 1.43.9, 1.44.6, 1.45.4, and 1.46.0 are affected. The CVSS 4.0 score of 5.1 with low confidentiality impact (VC:L) reflects a bounded but real data leakage risk; no public exploit identified at time of analysis.

Technical ContextAI

MediaWiki is a PHP-based wiki platform (cpe:2.3:a:wikimedia_foundation:mediawiki:*:*:*:*:*:*:*:*) that exposes administrative functions through a structured API. The affected file, includes/Api/ApiUserrights.php, handles the action=userrights API endpoint responsible for granting and revoking user group memberships. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) indicates the root cause is insufficient access control or filtering when returning data through this API endpoint - likely returning user rights details, change logs, or actor metadata to callers whose privilege level does not warrant that information. The CVSS 4.0 vector AT:N confirms no special attack preconditions beyond authenticated access are required on the target system's side.

RemediationAI

Upgrade MediaWiki to one of the patched releases: 1.43.9, 1.44.6, 1.45.4, or 1.46.0, whichever aligns with the currently deployed branch. Vendor-released patches exist for all four supported branches. The upstream tracking task is at https://phabricator.wikimedia.org/T422085. If immediate upgrade is not possible, a compensating control is to restrict access to the action=userrights API endpoint via MediaWiki's $wgAPIModules configuration or web server rules (e.g., blocking requests where action=userrights from untrusted IP ranges), though this may break legitimate rights-management tooling. Additionally, auditing which low-privileged accounts have API access (via $wgEnableAPI and $wgEnableWriteAPI settings) and limiting it to trusted users reduces exposure surface. No patch-independent fix that fully neutralizes the flaw has been confirmed.