Vulnerability in Wikimedia Foundation AbuseFilter. This issue affects AbuseFilter: from * before 1.43.7, 1.44.4, 1.45.2.

According to its self-reported version number, the instance of MediaWiki hosted on the remote web server is prior to 1.43.7, 1.44.x prior to 1.44.4 or 1.45.x prior to 1.45.2. It is, therefore, affected by a number of vulnerabilities as follows.

- Block UI elements in the 'tools' sidebar reveal the presence of an autoblocked IP. (CVE-2026-34092)

- RecentChanges entries expose suppressed content via generated log page HTML. (CVE-2026-34088)

- User localization is leaked by AbuseFilter + EventStream. (CVE-2026-34091)

- Suggested investigations do not handle suppressed usernames. (CVE-2026-34090)

- The Users API leaks whether privileged users have their user groups disabled for lack of 2FA. (CVE-2026-34087)

- Special:UserRights allows viewing user rights from a private wiki. (CVE-2026-34093)

- AbuseFilter misuses ::userCanBitfield, exposing access-controlled information. (CVE-2026-34086)

- The customized help link for the page protection indicator is relative to the subpage name. (CVE-2026-34094)

- A memory leak in Scribunto causes runJobs.php to run out of memory. (CVE-2026-34089)

- action=raw with a Special:Mypage subpage responds with text/html on a javascript request. (CVE-2026-34095)

- The Notifications (Echo) API can be used by any OAuth tool. (CVE-2026-5266)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6208 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6208-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     April 12, 2026                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : mediawiki     CVE ID         : CVE-2026-34086 CVE-2026-34087 CVE-2026-34088                      CVE-2026-34091 CVE-2026-34092 CVE-2026-34093                      CVE-2026-34094 CVE-2026-34095 CVE-2026-5266

    Multiple security issues were discovered in MediaWiki, a website engine     for collaborative work, which could result in information disclosure or     incomplete permission checks.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 1:1.39.17-1+deb12u2.

    For the stable distribution (trixie), these problems have been fixed in     version 1:1.43.8+dfsg-1~deb13u1.

    We recommend that you upgrade your mediawiki packages.

    For the detailed security status of mediawiki please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/mediawiki

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vulnerability in Wikimedia Foundation AbuseFilter. This issue affects AbuseFilter: from * before 1.43.7,     1.44.4, 1.45.2. (CVE-2026-34086)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
115327	MediaWiki 1.45.x < 1.45.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
115326	MediaWiki 1.44.x < 1.44.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
115325	MediaWiki < 1.43.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
307633	Debian dsa-6208 : mediawiki - security update	Nessus	Debian Local Security Checks	Local	medium
304875	Linux Distros Unpatched Vulnerability : CVE-2026-34086	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-34086

low

Tenable Plugins

medium

medium

medium

medium

low