Is there a patch available for CVE-2026-58026?

Yes, a patch is available for CVE-2026-58026. Update the affected software to the latest version immediately.

MediaWiki CVE-2026-58026

EUVD-2026-41024 NONE

Information Exposure (CWE-200)

2026-07-01 wikimedia-foundation

GHSA-jp4p-rf6v-wv5p

PHP Information Disclosure Mediawiki Wikimedia Foundation

Severity by source

Vendor (wikimedia-foundation) PRIMARY

0.0 NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N

vuln.today AI

3.5 LOW

Network-accessible parser flaw requiring authenticated low-privilege user and interaction; limited confidentiality impact only, no integrity or availability consequence.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (wikimedia-foundation).

CVSS VectorVendor: wikimedia-foundation

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Lifecycle Timeline

Patch available

Jul 01, 2026 - 17:01 EUVD

Analysis Generated

Jul 01, 2026 - 16:05 vuln.today

DescriptionCVE.org

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.

This vulnerability is associated with program files includes/Parser/Parser.Php.

This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

AnalysisAI

Information disclosure in MediaWiki's core parser component (includes/Parser/Parser.php) allows authenticated low-privilege users, under conditions requiring user interaction, to obtain sensitive information not intended for their access level. All MediaWiki branches are affected up to versions 1.43.9, 1.44.6, 1.45.4, and 1.46.0, covering a broad installation base including self-hosted wikis worldwide. No public exploit code exists and no active exploitation has been confirmed at time of analysis; however, the provided CVSS 4.0 vector contains a contradictory zero-impact scoring that warrants independent verification against the upstream advisory.

Technical ContextAI

MediaWiki is a PHP-based wiki engine (CPE: cpe:2.3:a:wikimedia_foundation:mediawiki:*:*:*:*:*:*:*:*) and the platform underlying Wikipedia and thousands of public and private wikis. The vulnerability resides in includes/Parser/Parser.php, the central wikitext-to-HTML rendering engine responsible for processing user-supplied markup, invoking templates, and generating page output. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause class: the parser either fails to properly restrict what data is accessible during rendering or inadvertently surfaces internal state, template content, or configuration-derived values to actors who should not receive them. Because the parser is invoked on nearly every page view, even a subtle information leakage at this layer can have broad reach.

RemediationAI

Upgrade MediaWiki to the appropriate patched release for your active branch: 1.43.9, 1.44.6, 1.45.4, or 1.46.0. Patch details and release notes are available at https://phabricator.wikimedia.org/T299359. As a pre-patch compensating control, consider restricting wiki access to authenticated users only via MediaWiki's $wgGroupPermissions configuration (setting 'read' permission to require login), which removes the unauthenticated attack surface - note this trade-off breaks public read access and may not be acceptable for open wikis. Additionally, reviewing and tightening parser extension permissions and disabling any experimental parser features not in active use may reduce exposure, though no specific feature is named in available data. Do not rely on the zero-impact CVSS score as a reason to defer patching without first confirming the nature of the disclosed information from the upstream advisory.