CVE-2026-34091
CVE-2026-34091 · User localization leaked by AbuseFilter + EventStream
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
CVSS 5.5 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
mediawiki
- Versions
- ≥ *, < 1.43.7, 1.44.4, 1.45.2: Affected (semver)
Update to 1.43.7, 1.44.4, 1.45.2
mediawiki Debian:13
- Versions
- 1:1.43.3+dfsg-1
- 1:1.43.5+dfsg-1
- 1:1.43.6+dfsg-1
- 1:1.43.6+dfsg-1~deb13u1
- 1:1.43.6+dfsg-2
- Affected ranges
- ECOSYSTEM: < 1:1.43.8+dfsg-1~deb13u1
Update to 1:1.43.8+dfsg-1~deb13u1
mediawiki Debian:14
- Versions
- 1:1.43.3+dfsg-1
- 1:1.43.5+dfsg-1
- 1:1.43.6+dfsg-1
- 1:1.43.6+dfsg-1~deb13u1
- 1:1.43.6+dfsg-2
- 1:1.43.8+dfsg-1~deb13u1
- Affected ranges
- ECOSYSTEM: < 1:1.43.8+dfsg-1
Update to 1:1.43.8+dfsg-1
mediawiki Ubuntu:25.10
- Versions
- 1:1.43.1+dfsg-1
- 1:1.43.1+dfsg-2
- 1:1.43.3+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mediawiki Ubuntu:26.04:LTS
- Versions
- 1:1.43.3+dfsg-1
- 1:1.43.5+dfsg-1
- 1:1.43.6+dfsg-2
- 1:1.43.8+dfsg-1
- Affected ranges
- ECOSYSTEM: < 1:1.43.8+dfsg-2
Update to 1:1.43.8+dfsg-2