← CVE Intelligence

CVE-2026-100244

CentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669) PUBLISHED

Description (CNA)

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows Excavation. This issue affects Mediawiki - CentralAuth Extension: from * before 1.46.1, 1.45.5, 1.43.10.

Affected (CNA)

Vendor / productVersions
Wikimedia Foundation / Mediawiki - CentralAuth Extensionaffected * before 1.46.1, 1.45.5, 1.43.10

CWE

CWE-200

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.