Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Skin/Skin.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

According to its self-reported version number, the instance of MediaWiki hosted on the remote web server is prior to 1.43.7, 1.44.x prior to 1.44.4 or 1.45.x prior to 1.45.2. It is, therefore, affected by a number of vulnerabilities as follows.

- Block UI elements in the 'tools' sidebar reveal the presence of an autoblocked IP. (CVE-2026-34092)

- RecentChanges entries expose suppressed content via generated log page HTML. (CVE-2026-34088)

- User localization is leaked by AbuseFilter + EventStream. (CVE-2026-34091)

- Suggested investigations do not handle suppressed usernames. (CVE-2026-34090)

- The Users API leaks whether privileged users have their user groups disabled for lack of 2FA. (CVE-2026-34087)

- Special:UserRights allows viewing user rights from a private wiki. (CVE-2026-34093)

- AbuseFilter misuses ::userCanBitfield, exposing access-controlled information. (CVE-2026-34086)

- The customized help link for the page protection indicator is relative to the subpage name. (CVE-2026-34094)

- A memory leak in Scribunto causes runJobs.php to run out of memory. (CVE-2026-34089)

- action=raw with a Special:Mypage subpage responds with text/html on a javascript request. (CVE-2026-34095)

- The Notifications (Echo) API can be used by any OAuth tool. (CVE-2026-5266)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8315-1 advisory.

    It was discovered that MediaWiki incorrectly handled group membership

    visibility in the OATHAuth extension. An authenticated attacker could

    use this issue to determine if other users had two-factor authentication

    enabled. (CVE-2026-34087)

    It was discovered that MediaWiki incorrectly handled suppressed log entry

    titles in the RecentChanges list. An unauthenticated attacker could use

    this issue to view titles of deleted or suppressed pages that should be hidden. (CVE-2026-34088)

    It was discovered that MediaWiki incorrectly handled resource loading timing information. An attacker     could use this issue to determine if certain pages

    existed on a wiki. (CVE-2026-34092)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6208 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6208-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     April 12, 2026                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : mediawiki     CVE ID         : CVE-2026-34086 CVE-2026-34087 CVE-2026-34088                      CVE-2026-34091 CVE-2026-34092 CVE-2026-34093                      CVE-2026-34094 CVE-2026-34095 CVE-2026-5266

    Multiple security issues were discovered in MediaWiki, a website engine     for collaborative work, which could result in information disclosure or     incomplete permission checks.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 1:1.39.17-1+deb12u2.

    For the stable distribution (trixie), these problems have been fixed in     version 1:1.43.8+dfsg-1~deb13u1.

    We recommend that you upgrade your mediawiki packages.

    For the detailed security status of mediawiki please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/mediawiki

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation     MediaWiki. This vulnerability is associated with program files includes/Skin/Skin.Php. This issue affects     MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2. (CVE-2026-34092)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
115327	MediaWiki 1.45.x < 1.45.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
115326	MediaWiki 1.44.x < 1.44.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
115325	MediaWiki < 1.43.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
317472	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : MediaWiki vulnerabilities (USN-8315-1)	Nessus	Ubuntu Local Security Checks	Local	medium
307633	Debian dsa-6208 : mediawiki - security update	Nessus	Debian Local Security Checks	Local	medium
304889	Linux Distros Unpatched Vulnerability : CVE-2026-34092	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-34092

low

Tenable Plugins

medium

medium

medium

medium

medium

low