← CVE Intelligence

CVE-2025-23074

Special:EditProfile exposes the contents of profile fields marked "hidden"/friends or "friends of friends" when the privileged user isn't a friend of the user whose profile they edit(ed) PUBLISHED

Description (CNA)

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - SocialProfile Extension allows Functionality Misuse.This issue affects Mediawiki - SocialProfile Extension: from 1.39.X before 1.39.11, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.

Affected (CNA)

Vendor / productVersions
Wikimedia Foundation / Mediawiki - SocialProfile Extensionaffected 1.39.x before 1.39.11; affected 1.41.x before 1.41.3; affected 1.42.x before 1.42.2

CWE

CWE-200

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.