MediaWiki FlaggedRevs CVE-2026-96879

Requires a MediaWiki installation with the FlaggedRevs extension enabled at version 1.46.0 or earlier - FlaggedRevs is an optional, separately-installed review/flagging extension, not part of MediaWiki core, so wikis without it are unaffected. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed and the attack is network-reachable, but exploitation is bounded by the low confidentiality impact (only limited sensitive information leaks) and by the specific FlaggedRevs code path handling revision review/transfer. The exact feature or endpoint that fails to strip the data is not detailed in the single Phabricator reference.

This is a moderate-severity information-disclosure issue that should be treated as low-to-medium operational priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N with SC:L) describes a network-reachable, unauthenticated, low-complexity flaw whose only impact is partial confidentiality - no integrity or availability effect - which matches CWE-212 (improper removal of sensitive information before storage or transfer). CISA SSVC reinforces a measured priority: Exploitation=none (no observed activity), Automatable=yes (it can be scripted, since it is remote and needs no interaction), and Technical Impact=partial (consistent with VC:L). There is no EPSS score, no CISA KEV listing, and no public proof-of-concept provided; exploitation status is therefore 'no public exploit identified at time of analysis.' The signals are internally consistent - a genuinely remote, low-privilege info leak - but the impact ceiling is low (only limited sensitive data leaks, not credentials or full content dumps as far as the description states). The chief limitation on confidence is that the single reference is a Phabricator task (T433020) with no fixed-version, patch commit, or detailed technical writeup, so the exact leaked data type and trigger cannot be independently confirmed. Net: a real but low-impact confidentiality bug, not a high-urgency threat.

An unauthenticated remote user interacts with a MediaWiki wiki running the FlaggedRevs extension (version ≤1.46.0) and, through the review/flagging workflow, retrieves content or metadata that should have been stripped before display or transfer - for example pending, hidden, or otherwise restricted revision information. Because the flaw needs no privileges and no user interaction, requests can be automated (SSVC Automatable=yes). No public proof-of-concept is available at time of analysis.