CVE-2026-34092 Wikimedia Foundation CVE debrief

Who should care

Defenders responsible for MediaWiki installations, particularly those with sensitive information, should assess exposure and prioritize verification and remediation. This includes reviewing and adjusting access controls for sensitive information, monitoring for potential unauthorized access, and verifying and upgrading to patched versions of MediaWiki.

Why it matters

CVE-2026-34092 is a low-severity vulnerability in MediaWiki that allows unauthorized actors to access sensitive information. Defenders responsible for MediaWiki installations, particularly those with sensitive information, should assess exposure and prioritize verification and remediation.

• Verify and confirm exposure of sensitive information in MediaWiki installations
• Assess and adjust access controls for sensitive information
• Prioritize upgrading to patched versions of MediaWiki

Technical summary

The vulnerability is caused by a weakness in the includes/Skin/Skin.Php program file of MediaWiki, which allows unauthorized actors to access sensitive information. The issue has a CVSS score of 2.1 and is classified as a low-severity vulnerability. This vulnerability affects MediaWiki versions before 1.43.7, 1.44.4, and 1.45.2. Defenders should prioritize verifying and upgrading to patched versions of MediaWiki, as well as reviewing and adjusting access controls for sensitive information. There is limited information available about the specific details of the vulnerability.

Defensive priority

Defenders should prioritize verifying and upgrading to patched versions of MediaWiki, as well as reviewing and adjusting access controls for sensitive information.

Recommended defensive actions

• Verify and upgrade to patched versions of MediaWiki (1.43.7, 1.44.4, or 1.45.2)
• Review and adjust access controls for sensitive information
• Monitor for potential unauthorized access to sensitive information
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 2.1 and affected versions of MediaWiki. The vulnerability is caused by a weakness in the includes/Skin/Skin.Php program file of MediaWiki, which allows unauthorized actors to access sensitive information. There is limited information available about the specific details of the vulnerability, and defenders should verify and confirm exposure of sensitive information in MediaWiki installations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.