Is there a patch available for EUVD-2026-41045?

Yes, a patch is available for EUVD-2026-41045. Update the affected software to the latest version immediately.

MediaWiki EUVD-2026-41045

Q: What is the CVSS score of EUVD-2026-41045?

EUVD-2026-41045 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-58033 MEDIUM

Information Exposure (CWE-200)

2026-07-01 wikimedia-foundation

GHSA-r39h-799c-h846

PHP Information Disclosure Mediawiki Wikimedia Foundation

5.3

CVSS 4.0 · Vendor: wikimedia-foundation

Severity by source

Vendor (wikimedia-foundation) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-accessible with no privileges required; UI:R reflects the passive user interaction indicated by CVSS 4.0 UI:P; confidentiality impact is Low with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (wikimedia-foundation).

CVSS VectorVendor: wikimedia-foundation

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 01, 2026 - 17:01 EUVD

Analysis Generated

Jul 01, 2026 - 16:02 vuln.today

DescriptionCVE.org

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.

This vulnerability is associated with program files includes/Actions/InfoAction.Php.

This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

AnalysisAI

Sensitive information exposure in MediaWiki's InfoAction.php allows unauthenticated remote actors to obtain restricted page metadata through the 'Info' action endpoint. All MediaWiki versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9 are affected across all deployment configurations. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the low attack complexity and lack of authentication requirements make opportunistic discovery straightforward for any actor who can reach the wiki.

Technical ContextAI

MediaWiki is the PHP-based wiki engine powering Wikipedia and thousands of public and private wikis globally (CPE: cpe:2.3:a:wikimedia_foundation:mediawiki:*:*:*:*:*:*:*:*). The affected component is includes/Actions/InfoAction.php, which handles the 'action=info' endpoint that presents page-level metadata - such as watcher counts, edit statistics, author information, or page properties - to users visiting a wiki page. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) indicates a straightforward access-control gap: information that should be gated behind authentication or privilege checks is surfaced to anonymous actors. The root cause is likely insufficient visibility control within the InfoAction handler, allowing page metadata fields intended for privileged users to leak to unauthenticated or unprivileged requests.

RemediationAI

The primary fix is to upgrade MediaWiki to one of the patched releases: 1.46.0, 1.45.4, 1.44.6, or 1.43.9, depending on the branch in use. Administrators should consult the Wikimedia Foundation's Phabricator task at https://phabricator.wikimedia.org/T427235 for release notes and upgrade guidance. If immediate upgrading is not feasible, a targeted workaround is to restrict access to the 'action=info' endpoint via web server configuration (nginx location block or Apache mod_rewrite rule) to only authenticated sessions or trusted IP ranges - note this disables the page information feature for all users, which may affect legitimate use. Alternatively, deploying a reverse proxy or WAF rule to block or authenticate requests containing 'action=info' in query parameters provides a compensating control without a full upgrade, though this may break MediaWiki's own internal use of that endpoint.