Is there a patch available for CVE-2026-58036?

Yes, a patch is available for CVE-2026-58036. Update the affected software to the latest version immediately.

MediaWiki CVE-2026-58036

Q: What is the CVSS score of CVE-2026-58036?

CVE-2026-58036 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41039 LOW

Information Exposure (CWE-200)

2026-07-01 wikimedia-foundation

GHSA-qf2r-x8qv-xrwx

PHP Information Disclosure Mediawiki Wikimedia Foundation

2.1

CVSS 4.0 · Vendor: wikimedia-foundation

Severity by source

Vendor (wikimedia-foundation) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

2.6 LOW

Network vector with high complexity and low privileges; user interaction required; only low confidentiality impact with no integrity or availability effect.

3.1 AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (wikimedia-foundation).

CVSS VectorVendor: wikimedia-foundation

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 01, 2026 - 17:01 EUVD

Analysis Generated

Jul 01, 2026 - 16:02 vuln.today

DescriptionCVE.org

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.

This vulnerability is associated with program files includes/Api/ApiQueryAllUsers.Php, includes/Api/ApiQueryUsers.Php, includes/Permissions/PermissionManager.Php, includes/User/UserGroupManager.Php.

AnalysisAI

Insufficient permission enforcement in MediaWiki's user query API endpoints allows low-privileged authenticated users to access sensitive user information - such as group memberships or account details - that permission controls should restrict. The vulnerability spans four source files: ApiQueryAllUsers.php, ApiQueryUsers.php, PermissionManager.php, and UserGroupManager.php, indicating that the flaw lies in how permission checks are applied (or bypassed) when the API serializes user data. No public exploit code exists and the CVSS 4.0 score of 2.1 reflects the constrained real-world exploitability. No confirmed active exploitation (CISA KEV) has been reported.

Technical ContextAI

MediaWiki is the PHP-based wiki platform powering Wikipedia and thousands of institutional wikis. The affected components are part of its Action API layer: ApiQueryAllUsers and ApiQueryUsers handle structured queries against the user database and return user attributes (groups, rights, registration dates, etc.); PermissionManager centralizes capability and permission gate logic; UserGroupManager handles group assignment and lookup. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) indicates that the root cause is an authorization bypass or missing gate - likely a scenario where the API returns fields that should be filtered by PermissionManager or UserGroupManager checks but are not, depending on the caller's privilege level. The affected CPE is cpe:2.3:a:wikimedia_foundation:mediawiki:*:*:*:*:*:*:*:* with no version range constrained in available data.

RemediationAI

No vendor-released patched version has been independently confirmed from the available reference data. The Wikimedia Foundation's Phabricator task T425406 (https://phabricator.wikimedia.org/T425406) is the primary tracking reference and should be monitored for patch status and fix version announcement. As a compensating control, administrators can restrict access to the MediaWiki Action API (api.php) for unauthenticated and low-privileged users via LocalSettings.php using $wgAPIModulesDisable or by restricting the 'allusers' and 'users' query modules; however, this may break legitimate integrations that depend on user enumeration APIs. Ensuring that wiki user registration is restricted to trusted individuals reduces the population of accounts that could exploit PR:L conditions. Monitor Wikimedia Security announcements and apply the official patch as soon as it is released.