Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for Mediawiki - FlaggedRevs extension by The Wikimedia Foundation

    CVE-2026-96879 (GCVE-0-2026-96879)

    Vulnerability from nvd – Published: 2026-09-25 20:10 – Updated: 2026-09-29 21:22
    VLAI
    Title
    "Checked by" label in page history should not be shown if the underlying review log entry is suppressed"
    Summary
    Improper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation's Mediawiki - FlaggedRevs extension through 1.46.0.
    Severity
    6.9 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-25 20:41 UTC
    CWE
    • CWE-212 - Improper removal of sensitive information before storage or transfer
    Assigner
    wikimedia-foundation CNA under the mitre root
    CNA scorecard C 69/100 over 81 records in the last 180 days details
    References
    Impacted products
    Date Public
    2026-09-25 19:57
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-96879",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-25T20:41:45.708316Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-25T20:41:55.111Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Mediawiki - FlaggedRevs extension",
          "vendor": "The Wikimedia Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.46.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-09-25T19:57:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation\u0027s Mediawiki - FlaggedRevs extension\u003cspan\u003e\u0026nbsp;through 1.46.0.\u003c/span\u003e"
            }
          ],
          "value": "Improper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation\u0027s Mediawiki - FlaggedRevs extension\u00a0through 1.46.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-212",
              "description": "CWE-212 Improper removal of sensitive information before storage or transfer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T21:22:40.501Z",
        "orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
        "shortName": "wikimedia-foundation"
      },
      "references": [
        {
          "url": "https://phabricator.wikimedia.org/T433020"
        },
        {
          "url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/FlaggedRevs/+/1344737"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "\"Checked by\" label in page history should not be shown if the underlying review log entry is suppressed\"",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
    "assignerShortName": "wikimedia-foundation",
    "cveId": "CVE-2026-96879",
    "datePublished": "2026-09-25T20:10:22.476Z",
    "dateReserved": "2026-09-23T18:14:23.766Z",
    "dateUpdated": "2026-09-29T21:22:40.501Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-96879 (GCVE-0-2026-96879)

    Vulnerability from cvelistv5 – Published: 2026-09-25 20:10 – Updated: 2026-09-29 21:22
    VLAI
    Title
    "Checked by" label in page history should not be shown if the underlying review log entry is suppressed"
    Summary
    Improper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation's Mediawiki - FlaggedRevs extension through 1.46.0.
    Severity
    6.9 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-25 20:41 UTC
    CWE
    • CWE-212 - Improper removal of sensitive information before storage or transfer
    Assigner
    wikimedia-foundation CNA under the mitre root
    CNA scorecard C 69/100 over 81 records in the last 180 days details
    References
    Impacted products
    Date Public
    2026-09-25 19:57
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-96879",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-25T20:41:45.708316Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-25T20:41:55.111Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Mediawiki - FlaggedRevs extension",
          "vendor": "The Wikimedia Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.46.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-09-25T19:57:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation\u0027s Mediawiki - FlaggedRevs extension\u003cspan\u003e\u0026nbsp;through 1.46.0.\u003c/span\u003e"
            }
          ],
          "value": "Improper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation\u0027s Mediawiki - FlaggedRevs extension\u00a0through 1.46.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-212",
              "description": "CWE-212 Improper removal of sensitive information before storage or transfer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T21:22:40.501Z",
        "orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
        "shortName": "wikimedia-foundation"
      },
      "references": [
        {
          "url": "https://phabricator.wikimedia.org/T433020"
        },
        {
          "url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/FlaggedRevs/+/1344737"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "\"Checked by\" label in page history should not be shown if the underlying review log entry is suppressed\"",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
    "assignerShortName": "wikimedia-foundation",
    "cveId": "CVE-2026-96879",
    "datePublished": "2026-09-25T20:10:22.476Z",
    "dateReserved": "2026-09-23T18:14:23.766Z",
    "dateUpdated": "2026-09-29T21:22:40.501Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}