CVE-2026-34087

Users API leaks whether privileged users have their user groups disabled for lack of 2FA PUBLISHED

Description (CNA)

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth. This issue affects OATHAuth: from * before 1.43.7, 1.44.4, 1.45.2.

Affected (CNA)

Vendor / product	Versions
Wikimedia Foundation / OATHAuth	affected * before 1.43.7, 1.44.4, 1.45.2

CWE

CWE-200

References

https://phabricator.wikimedia.org/T412061

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.