AbuseFilter CVE-2026-58027

Exploitation requires an authenticated session using a low-privilege registered account on a MediaWiki installation with the AbuseFilter extension installed and enabled, running any version prior to 1.46.0, 1.45.4, 1.44.6, or 1.43.9. The attack is conducted entirely via the MediaWiki API (network-accessible), specifically targeting the QueryAbuseFilters module in includes/Api/QueryAbuseFilters.php. For the attack to yield meaningful value, the target wiki must have private or restricted abuse filters configured - wikis with no private filters are not meaningfully impacted. Exploitation is bounded to confidentiality disclosure of filter rule details; no integrity or availability impact is possible through this vector. On wikis with open user registration, any self-registered account satisfies the low-privilege prerequisite without requiring special role assignment.

The CVSS 4.0 base score of 5.3 (Medium) is grounded in a network-accessible (AV:N), low-complexity (AC:L), low-privilege-required (PR:L) attack path with limited confidentiality impact (VC:L) and no integrity or availability impact (VI:N/VA:N), which accurately reflects an information disclosure of filter metadata rather than sensitive user data or system-level compromise. The absence of a CISA KEV listing and no confirmed POC code further supports treating this as a moderate-priority issue rather than an emergency. The realistic operational risk, however, is non-trivial for wikis that rely on private filter rules as a core abuse-prevention mechanism: disclosure of exact regex patterns or filter logic enables targeted evasion of automated moderation. EPSS data was not provided in available intelligence, so exploitation probability cannot be quantitatively assessed. No conflicting signals exist between the CVSS vector and the description - both consistently indicate a network-reachable, low-privilege, limited-impact flaw.

An attacker registers a standard low-privilege user account on a MediaWiki wiki running an unpatched AbuseFilter version, then authenticates and issues a crafted API request to the QueryAbuseFilters endpoint to enumerate private filter configurations. Armed with the precise regex patterns and conditions used in private abuse filters, the attacker crafts edits or posts that match the exact gaps in coverage, sustaining spam, vandalism, or policy-violating edits that evade automated detection. No public proof-of-concept code is confirmed at time of analysis, but the attack requires only basic knowledge of the MediaWiki API.