Skip to main content

MediaWiki EUVD-2026-29063

| CVE-2026-34091 MEDIUM
Information Exposure (CWE-200)
2026-05-11 wikimedia-foundation GHSA-7gvw-7r69-cgx7
Information Disclosure Mediawiki
5.5
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

5
Analysis Generated
May 11, 2026 - 18:01 vuln.today
Patch available
May 11, 2026 - 17:01 EUVD
CVSS changed
May 11, 2026 - 16:22 NVD
5.5 (MEDIUM)
CVE Published
May 11, 2026 - 14:55 nvd
MEDIUM 5.5
CVE Published
May 11, 2026 - 14:55 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.

This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

AnalysisAI

Exposure of sensitive information in Wikimedia Foundation MediaWiki allows remote unauthenticated attackers to access unauthorized data via network requests against affected versions before 1.43.7, 1.44.4, and 1.45.2. The vulnerability has low confidentiality impact with CVSS 5.5 and evidence of proof-of-concept code, though no active exploitation in CISA KEV has been confirmed at time of analysis.

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify vulnerable MediaWiki instance
Exploit
Craft HTTP request to disclosure endpoint
Execution
Retrieve sensitive information
Impact
Exfiltrate data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Remote unauthenticated attackers can exploit this vulnerability against default MediaWiki configurations accessible over the network. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This vulnerability presents moderate real-world risk despite the 5.5 CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker discovers a publicly accessible MediaWiki instance running version 1.45.0 and sends a crafted HTTP request to an information disclosure endpoint, retrieving sensitive data such as user email addresses, user identities, or private configuration details without authentication. The low attack complexity means the exploit requires minimal customization; the attacker may automate scanning and exploitation across multiple MediaWiki instances.
Remediation Upgrade to the patched versions immediately: MediaWiki 1.43.7, 1.44.4, or 1.45.2 depending on your current branch. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Share

EUVD-2026-29063 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy