CVE-2026-39937
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The CentralAuth extension of MediaWiki improperly removes sensitive information before storage or transfer, leading to resource leak exposure. The issue is fixed on the master branch and in versions 1.43, 1.44, and 1.45.
Risk Assessment
Sensitive data may be exposed to unauthorized parties, compromising confidentiality and potentially enabling further attacks.
Recommendation
Update MediaWiki and the CentralAuth extension to the patched versions (1.43, 1.44, or 1.45).
Other vulnerabilities in MediaWiki - CentralAuth Extension
See all- CVE-2026-103047Medium
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth extension allows Stored XSS. This issue affects Mediawiki - CentralAuth extension: before 1.46.1, 1.45.5, 1.43.10.
- CVE-2026-100244High
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows data excavation. Affects versions from * before 1.46.1, 1.45.5, 1.43.10.
- CVE-2025-62669Medium
The CentralAuth extension for MediaWiki exposes sensitive information to unauthorized actors, leading to resource leak exposure. This affects versions from master before 1.39.
Original NVD description (English source)
Improper removal of sensitive information before storage or transfer vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resource Leak Exposure. The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS