CVE-2026-39937 The Wikimedia Foundation CVE debrief

Who should care

Defenders of MediaWiki installations using the CentralAuth Extension, operators of MediaWiki platforms, vulnerability management teams, and security teams should verify their inventory and assess the vulnerability's impact. They should review compensating controls for exposed systems while remediation is scheduled and verified.

Technical summary

CVE-2026-39937 is an Improper removal of sensitive information before storage or transfer vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension. This issue allows Resource Leak Exposure and has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45. The vulnerability has a high CVSS score of 8.8, indicating a high severity. Affected product deployments should be identified, and owners assigned for follow-up. Official advisories or CVE records should be reviewed to validate affected scope, severity, and vendor guidance.

Defensive priority

High priority due to CVSS score of 8.8 and potential for sensitive information exposure.

Recommended defensive actions

• Verify MediaWiki CentralAuth Extension version and apply patches for versions 1.43, 1.44, and 1.45
• Review and update inventory of MediaWiki installations
• Monitor for potential sensitive information exposure
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation and verification are necessary to fully understand the issue. Defenders should verify MediaWiki installations using the CentralAuth Extension and assess the vulnerability's impact. Evidence is limited, and additional review of source references is required to confirm affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.