CheckUser CVE-2026-58034

Exploitation requires that the attacker already holds CheckUser-level privileges on the target MediaWiki installation - a role restricted to a small set of trusted administrators and not available to ordinary registered users or anonymous visitors. The attack is further constrained by AT:P (specific attack requirements present), indicating the Temporary Accounts feature or block workflow must be in use on the target wiki. Additionally, UI:A means a separate victim user with sufficient privilege must actively interact with the affected interface for XSS execution to occur. Exploitation is therefore limited by: (1) attacker must hold high-privilege CheckUser role, (2) the wiki must have the 1.46.0-rc.0 release candidate installed, (3) the Temporary Accounts blocking feature must be in active use, and (4) a second privileged user must actively view the manipulated field. This is not a remote unauthenticated attack surface.

Real-world risk is very low despite the network-accessible vector. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:A) encodes three significant constraints: PR:H requires the attacker already hold CheckUser-level privileges (a highly restricted role granted only to trusted administrators on MediaWiki installations), AT:P signals specific preconditions must be met for the attack to succeed, and UI:A requires active user interaction from a victim - meaning a second privileged user must actively engage with the injected content. The vendor-assigned CVSS 4.0 vector records all impact metrics as None (VC:N/VI:N/VA:N/SC:N/SI:N/SA:N), which is atypical for XSS but may reflect the very narrow blast radius: only other CheckUsers or similarly privileged users would be exposed, and the injected script's practical access to sensitive session data in this context appears limited. No EPSS score was provided. There is no KEV listing and no public POC, consistent with a narrow, privilege-constrained vulnerability with limited exploitation incentive.

An attacker who holds CheckUser-level privileges on a MediaWiki installation running CheckUser 1.46.0-rc.0 crafts a malicious input payload and submits it through the Temporary Accounts block interface, injecting script content into the blockConnectedTempAccountsField. A second privileged user (e.g., another CheckUser or administrator) who subsequently views the block interface encounters the injected script, which executes in their browser, potentially exfiltrating session cookies or performing actions on their behalf. No public proof-of-concept code has been identified at time of analysis.