EUVD-2026-41021
GHSA-xf4f-w4h8-w7rr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible API requires low-privilege authentication (PR:L); disclosure limited to filter rule metadata (C:L); no integrity or availability impact applies.
Primary rating from Vendor (wikimedia-foundation).
CVSS VectorVendor: wikimedia-foundation
Lifecycle Timeline
2DescriptionCVE.org
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter.
This vulnerability is associated with program files includes/Api/QueryAbuseFilters.Php.
This issue affects AbuseFilter: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
AnalysisAI
Sensitive abuse filter configuration data in Wikimedia Foundation's AbuseFilter MediaWiki extension is exposed to authenticated low-privilege users via the QueryAbuseFilters API endpoint (includes/Api/QueryAbuseFilters.php). Authenticated wiki users on affected installations (all versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9) can retrieve private or restricted filter rule details they should not be authorized to access. No active exploitation has been confirmed (not listed in CISA KEV) and no public proof-of-concept exploit is known at time of analysis, but the moderate CVSS 4.0 score of 5.3 reflects real risk to wikis relying on confidential filter logic for abuse prevention.
Technical ContextAI
AbuseFilter is a PHP-based MediaWiki extension widely deployed on Wikimedia Foundation projects (including Wikipedia) and self-hosted MediaWiki installations to automatically detect and prevent abusive edits through configurable filter rules, some of which are intentionally kept private to prevent circumvention. The vulnerable component is the API query module implemented in includes/Api/QueryAbuseFilters.php, which handles requests to the MediaWiki API's abusefilter query action. The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating that the API module fails to enforce sufficient access controls before returning filter data, allowing callers with only low-privilege authentication to retrieve configurations that should be restricted. The affected CPE is cpe:2.3:a:wikimedia_foundation:abusefilter:*:*:*:*:*:*:*:*, confirming the standalone AbuseFilter extension across all prior version branches.
RemediationAI
Upgrade the AbuseFilter MediaWiki extension to the appropriate patched version for your MediaWiki branch: 1.46.0, 1.45.4, 1.44.6, or 1.43.9. Select the branch corresponding to your installed MediaWiki version to ensure compatibility. The upstream fix and discussion are available at https://phabricator.wikimedia.org/T406954. As a compensating control prior to patching, administrators can review MediaWiki API permissions and restrict or disable external API access to the abusefilter query module for non-trusted users, though this may break legitimate uses by maintenance bots or trusted scripts relying on the QueryAbuseFilters API. Additionally, temporarily marking all sensitive filters as non-private (accepting the operational tradeoff of reduced filter secrecy) eliminates the information value of the disclosure until patching is feasible.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today