Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Specials/SpecialUserRights.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

According to its self-reported version number, the instance of MediaWiki hosted on the remote web server is prior to 1.43.7, 1.44.x prior to 1.44.4 or 1.45.x prior to 1.45.2. It is, therefore, affected by a number of vulnerabilities as follows.

- Block UI elements in the 'tools' sidebar reveal the presence of an autoblocked IP. (CVE-2026-34092)

- RecentChanges entries expose suppressed content via generated log page HTML. (CVE-2026-34088)

- User localization is leaked by AbuseFilter + EventStream. (CVE-2026-34091)

- Suggested investigations do not handle suppressed usernames. (CVE-2026-34090)

- The Users API leaks whether privileged users have their user groups disabled for lack of 2FA. (CVE-2026-34087)

- Special:UserRights allows viewing user rights from a private wiki. (CVE-2026-34093)

- AbuseFilter misuses ::userCanBitfield, exposing access-controlled information. (CVE-2026-34086)

- The customized help link for the page protection indicator is relative to the subpage name. (CVE-2026-34094)

- A memory leak in Scribunto causes runJobs.php to run out of memory. (CVE-2026-34089)

- action=raw with a Special:Mypage subpage responds with text/html on a javascript request. (CVE-2026-34095)

- The Notifications (Echo) API can be used by any OAuth tool. (CVE-2026-5266)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4640 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4640-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     June 22, 2026                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : mediawiki     Version        : 1:1.35.13-1+deb11u7 $bookworm_VERSION     CVE ID         : CVE-2026-34087 CVE-2026-34088 CVE-2026-34093 CVE-2026-34095

    Multiple security vulnerabilities were found in mediawiki, a website     engine for collaborative work, which could lead to information     disclosure or access controls bypass.

    CVE-2026-34087

        OATHAuth extension: Users API leaks whether privileged users have         their user groups disabled for lack of 2FA.

    CVE-2026-34088

        RecentChanges entries expose suppressed content via generated log         page HTML.

    CVE-2026-34093

        Special:UserRights page allows viewing user rights from private         wiki.

    CVE-2026-34095

        action=raw with Special:Mypage subpage title responds with         Content-Type: text/html on ctype=text/javascript request, which         may lead to cross-site scripting.

    For Debian 11 bullseye, these problems have been fixed in version     1:1.35.13-1+deb11u7.

    For Debian 12 bookworm, these problems have been fixed in version     $bookworm_VERSION.

    We recommend that you upgrade your mediawiki packages.

    For the detailed security status of mediawiki please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/mediawiki

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6208 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6208-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     April 12, 2026                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : mediawiki     CVE ID         : CVE-2026-34086 CVE-2026-34087 CVE-2026-34088                      CVE-2026-34091 CVE-2026-34092 CVE-2026-34093                      CVE-2026-34094 CVE-2026-34095 CVE-2026-5266

    Multiple security issues were discovered in MediaWiki, a website engine     for collaborative work, which could result in information disclosure or     incomplete permission checks.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 1:1.39.17-1+deb12u2.

    For the stable distribution (trixie), these problems have been fixed in     version 1:1.43.8+dfsg-1~deb13u1.

    We recommend that you upgrade your mediawiki packages.

    For the detailed security status of mediawiki please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/mediawiki

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation     MediaWiki. This vulnerability is associated with program files includes/Specials/SpecialUserRights.Php.
    This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2. (CVE-2026-34093)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
115327	MediaWiki 1.45.x < 1.45.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
115326	MediaWiki 1.44.x < 1.44.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
115325	MediaWiki < 1.43.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
321929	Debian dla-4640 : mediawiki - security update	Nessus	Debian Local Security Checks	Local	medium
307633	Debian dsa-6208 : mediawiki - security update	Nessus	Debian Local Security Checks	Local	medium
304898	Linux Distros Unpatched Vulnerability : CVE-2026-34093	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-34093

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium