CVE-2026-100244
UnknownSummary
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows data excavation. Affects versions from * before 1.46.1, 1.45.5, 1.43.10.
Risk Assessment
The risk includes leakage of sensitive information such as credentials or personal data, potentially leading to privacy and security breaches.
Recommendation
Update Mediawiki - CentralAuth Extension to version 1.46.1, 1.45.5, or 1.43.10 (or later) to remediate the vulnerability.
Other vulnerabilities in Mediawiki - CentralAuth Extension
See all- CVE-2026-103047Unknown
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth extension allows Stored XSS. This issue affects Mediawiki - CentralAuth extension: before 1.46.1, 1.45.5, 1.43.10.
- CVE-2026-39937High
The CentralAuth extension of MediaWiki improperly removes sensitive information before storage or transfer, leading to resource leak exposure. The issue is fixed on the master branch and in versions 1.43, 1.44, and 1.45.
Original NVD description (English source)
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows Excavation. This issue affects Mediawiki - CentralAuth Extension: from * before 1.46.1, 1.45.5, 1.43.10.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS