Is there a patch available for EUVD-2026-41030?

Yes, a patch is available for EUVD-2026-41030. Update the affected software to the latest version immediately.

MediaWiki EUVD-2026-41030

Q: What is the CVSS score of EUVD-2026-41030?

EUVD-2026-41030 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

| CVE-2026-58029 MEDIUM

Improper Authentication (CWE-287)

2026-07-01 wikimedia-foundation

GHSA-gpg7-6j8p-9wg5

PHP Authentication Bypass Mediawiki Wikimedia Foundation

5.3

CVSS 4.0 · Vendor: wikimedia-foundation

Severity by source

Vendor (wikimedia-foundation) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Network-accessible auth endpoints require passive user interaction; scope changed to C due to subsequent-system impact (SC:L/SI:L in 4.0); no availability impact observed.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (wikimedia-foundation).

CVSS VectorVendor: wikimedia-foundation

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 01, 2026 - 17:01 EUVD

Analysis Generated

Jul 01, 2026 - 16:04 vuln.today

DescriptionCVE.org

Vulnerability in Wikimedia Foundation MediaWiki.

This vulnerability is associated with program files includes/Api/ApiChangeAuthenticationData.Php, includes/Api/ApiLinkAccount.Php, includes/Api/ApiRemoveAuthenticationData.Php, includes/Specials/SpecialLinkAccounts.Php, includes/Specials/SpecialUnlinkAccounts.Php.

This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

AnalysisAI

Authentication API endpoints and Special pages in MediaWiki expose low-severity confidentiality and integrity weaknesses exploitable by unauthenticated remote attackers who can induce victim user interaction. Five files spanning account-linking and credential management operations - ApiChangeAuthenticationData, ApiLinkAccount, ApiRemoveAuthenticationData, SpecialLinkAccounts, and SpecialUnlinkAccounts - are affected across all MediaWiki releases prior to the fixed branches 1.43.9, 1.44.6, 1.45.4, and the forthcoming 1.46.0. No public exploit code and no active exploitation have been identified at time of analysis; real-world risk is constrained by the user-interaction prerequisite and the limited impact scope.

Technical ContextAI

MediaWiki is the PHP-based wiki engine developed by the Wikimedia Foundation that powers Wikipedia and thousands of third-party wikis. The five affected source files reside in two subsystems: the Action API layer (includes/Api/) handling programmatic authentication operations (changeauthenticationdata, linkaccount, removeauthenticationdata actions) and the Special page subsystem (includes/Specials/) providing UI-driven account-linking and -unlinking workflows. These components integrate with MediaWiki's pluggable AuthManager framework, which brokers credential changes and external identity provider connections. The CVSS 4.0 vector attributes low confidentiality and low integrity impact to both the vulnerable system (VC:L/VI:L) and a subsequent system scope (SC:L/SI:L), consistent with the 'Information Disclosure' tag and indicating that data or state changes can leak or propagate beyond the immediate user session. CWE is listed as N/A, preventing precise root-cause classification; however, the UI:P and PR:N combination suggests a cross-site request forgery or improper output filtering pattern in these auth-adjacent endpoints. The CPE cpe:2.3:a:wikimedia_foundation:mediawiki:*:*:*:*:*:* confirms all upstream MediaWiki releases prior to the fix branches are affected.

RemediationAI

The primary remediation is to upgrade MediaWiki to a patched release: version 1.43.9, 1.44.6, or 1.45.4 depending on the deployed branch, or to 1.46.0 upon its release. The Wikimedia Foundation's Phabricator task at https://phabricator.wikimedia.org/T422676 should be reviewed for exact patch commit details and any release-specific guidance. For operators unable to upgrade immediately, a targeted compensating control is to restrict access to the affected API actions (action=changeauthenticationdata, action=linkaccount, action=removeauthenticationdata) and the Special:LinkAccounts and Special:UnlinkAccounts pages at the web server or WAF layer, limiting them to authenticated sessions only; the trade-off is that legitimate external identity provider linking workflows will be disrupted for unauthenticated or semi-authenticated user flows. Disabling the external account-linking feature via MediaWiki's $wgAuthManagerConfig if it is not actively used eliminates the attack surface in the SpecialLinkAccounts and SpecialUnlinkAccounts paths with no functional impact for those deployments.