CVE-2026-58036 — Users API leaks whether privileged users have their user groups disabled for lack of 2FA

CVE-2026-58036

Users API leaks whether privileged users have their user groups disabled for lack of 2FA PUBLISHED

Description (CNA)

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryAllUsers.Php, includes/Api/ApiQueryUsers.Php, includes/Permissions/PermissionManager.Php, includes/User/UserGroupManager.Php.

Affected (CNA)

Vendor / product	Versions
Wikimedia Foundation / MediaWiki	affected 1.46.0-rc.0 before 1.46.0

CWE

CWE-200

References

https://phabricator.wikimedia.org/T425406

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.