Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth. This issue affects OATHAuth: from * before 1.43.7, 1.44.4, 1.45.2.

According to its self-reported version number, the instance of MediaWiki hosted on the remote web server is prior to 1.43.7, 1.44.x prior to 1.44.4 or 1.45.x prior to 1.45.2. It is, therefore, affected by a number of vulnerabilities as follows.

- Block UI elements in the 'tools' sidebar reveal the presence of an autoblocked IP. (CVE-2026-34092)

- RecentChanges entries expose suppressed content via generated log page HTML. (CVE-2026-34088)

- User localization is leaked by AbuseFilter + EventStream. (CVE-2026-34091)

- Suggested investigations do not handle suppressed usernames. (CVE-2026-34090)

- The Users API leaks whether privileged users have their user groups disabled for lack of 2FA. (CVE-2026-34087)

- Special:UserRights allows viewing user rights from a private wiki. (CVE-2026-34093)

- AbuseFilter misuses ::userCanBitfield, exposing access-controlled information. (CVE-2026-34086)

- The customized help link for the page protection indicator is relative to the subpage name. (CVE-2026-34094)

- A memory leak in Scribunto causes runJobs.php to run out of memory. (CVE-2026-34089)

- action=raw with a Special:Mypage subpage responds with text/html on a javascript request. (CVE-2026-34095)

- The Notifications (Echo) API can be used by any OAuth tool. (CVE-2026-5266)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4640 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4640-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     June 22, 2026                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : mediawiki     Version        : 1:1.35.13-1+deb11u7 $bookworm_VERSION     CVE ID         : CVE-2026-34087 CVE-2026-34088 CVE-2026-34093 CVE-2026-34095

    Multiple security vulnerabilities were found in mediawiki, a website     engine for collaborative work, which could lead to information     disclosure or access controls bypass.

    CVE-2026-34087

        OATHAuth extension: Users API leaks whether privileged users have         their user groups disabled for lack of 2FA.

    CVE-2026-34088

        RecentChanges entries expose suppressed content via generated log         page HTML.

    CVE-2026-34093

        Special:UserRights page allows viewing user rights from private         wiki.

    CVE-2026-34095

        action=raw with Special:Mypage subpage title responds with         Content-Type: text/html on ctype=text/javascript request, which         may lead to cross-site scripting.

    For Debian 11 bullseye, these problems have been fixed in version     1:1.35.13-1+deb11u7.

    For Debian 12 bookworm, these problems have been fixed in version     $bookworm_VERSION.

    We recommend that you upgrade your mediawiki packages.

    For the detailed security status of mediawiki please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/mediawiki

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8315-1 advisory.

    It was discovered that MediaWiki incorrectly handled group membership

    visibility in the OATHAuth extension. An authenticated attacker could

    use this issue to determine if other users had two-factor authentication

    enabled. (CVE-2026-34087)

    It was discovered that MediaWiki incorrectly handled suppressed log entry

    titles in the RecentChanges list. An unauthenticated attacker could use

    this issue to view titles of deleted or suppressed pages that should be hidden. (CVE-2026-34088)

    It was discovered that MediaWiki incorrectly handled resource loading timing information. An attacker     could use this issue to determine if certain pages

    existed on a wiki. (CVE-2026-34092)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6208 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6208-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     April 12, 2026                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : mediawiki     CVE ID         : CVE-2026-34086 CVE-2026-34087 CVE-2026-34088                      CVE-2026-34091 CVE-2026-34092 CVE-2026-34093                      CVE-2026-34094 CVE-2026-34095 CVE-2026-5266

    Multiple security issues were discovered in MediaWiki, a website engine     for collaborative work, which could result in information disclosure or     incomplete permission checks.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 1:1.39.17-1+deb12u2.

    For the stable distribution (trixie), these problems have been fixed in     version 1:1.43.8+dfsg-1~deb13u1.

    We recommend that you upgrade your mediawiki packages.

    For the detailed security status of mediawiki please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/mediawiki

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth.
    This issue affects OATHAuth: from * before 1.43.7, 1.44.4, 1.45.2. (CVE-2026-34087)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
115327	MediaWiki 1.45.x < 1.45.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
115326	MediaWiki 1.44.x < 1.44.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
115325	MediaWiki < 1.43.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
321929	Debian dla-4640 : mediawiki - security update	Nessus	Debian Local Security Checks	medium
317472	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : MediaWiki vulnerabilities (USN-8315-1)	Nessus	Ubuntu Local Security Checks	medium
307633	Debian dsa-6208 : mediawiki - security update	Nessus	Debian Local Security Checks	medium
304897	Linux Distros Unpatched Vulnerability : CVE-2026-34087	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-34087

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium