CVE-2026-58024

unknown

Published 2026-07-01 · Modified 2026-07-01

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

—

CVSS v4 NEW

5.1

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

VIR risk

—

Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiUserrights.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Debian Security Tracker · View original ↗ · DFSG

CVE-2026-58024 NameCVE-2026-58024 DescriptionRestrict interwiki user lookup in ApiUserrights SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) Vulnerable and fixed packages The table below lists information on source packages. Source PackageReleaseVersionStatus mediawiki…

CVE-2026-58024

Name	CVE-2026-58024
Description	Restrict interwiki user lookup in ApiUserrights
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mediawiki (PTS)	bullseye	1:1.35.13-1+deb11u2	vulnerable
	bullseye (security)	1:1.35.13-1+deb11u7	vulnerable
	bookworm, bookworm (security)	1:1.39.17-1+deb12u2	vulnerable
	trixie, trixie (security)	1:1.43.8+dfsg-1~deb13u1	vulnerable
	forky, sid	1:1.43.8+dfsg-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
mediawiki	source	(unstable)	(unfixed)

Notes

https://phabricator.wikimedia.org/T422085
https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1268588 (master)
https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1306312 (REL1_43)

Home - Debian Security - Source (Git)

Apply commands

text fix

Notes

https://phabricator.wikimedia.org/T422085https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1268588 (master)https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1306312 (REL1_43)

OS impact

Debian Affected 5 releases

Version	Status	Fixed in
trixie	Affected	—
sid	Affected	—
forky	Affected	—
bullseye	Affected	—
bookworm	Affected	—

References

CWEs

CWE-200

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.