CVE-2026-58027
Full vulnerability record from the local CVENow database.
Description
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/Api/QueryAbuseFilters.Php. This issue affects AbuseFilter: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
Severity
MEDIUM
CVSS score
5.3
(v4.0)
Vulnerability status
Analyzed
Source identifier
c4f26cc8-17ff-4c99-b5e2-38fc1793eacc
Published
2026-07-01 16:16:49.947000
Last modified
2026-10-25 17:10:00.197000
View original CVE JSON
{
"id": "CVE-2026-58027",
"sourceIdentifier": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
"published": "2026-07-01T16:16:49.947",
"lastModified": "2026-10-25T17:10:00.197",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter.\n\n This vulnerability is associated with program files includes/Api/QueryAbuseFilters.Php.\n\n\n\nThis issue affects AbuseFilter: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9."
},
{
"lang": "es",
"value": "Exposición de Información Sensible a un Actor No Autorizado vulnerabilidad en Wikimedia Foundation AbuseFilter.\n\nEsta vulnerabilidad está asociada con archivos de programa includes/API/QueryAbuseFilters.PHP.\n\nEste problema afecta a AbuseFilter: desde * antes de 1.46.0, 1.45.4, 1.44.6, 1.43.9."
}
],
"affected": [
{
"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
"affectedData": [
{
"vendor": "Wikimedia Foundation",
"product": "AbuseFilter",
"defaultStatus": "unaffected",
"programFiles": [
"includes/Api/QueryAbuseFilters.php"
],
"repo": "https://gerrit.wikimedia.org/g/mediawiki/extensions/AbuseFilter/+/refs/heads/master",
"versions": [
{
"version": "*",
"lessThan": "1.46.0, 1.45.4, 1.44.6, 1.43.9",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-01T15:49:23.869052Z",
"id": "CVE-2026-58027",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-200"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*",
"versionStartIncluding": "1.43.0",
"versionEndExcluding": "1.43.9",
"matchCriteriaId": "5BC82408-61E8-4F28-8AEC-438E159DC867"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*",
"versionStartIncluding": "1.44.0",
"versionEndExcluding": "1.44.6",
"matchCriteriaId": "8F0FD7F7-0D82-4E68-91D8-0ADAE54CB8C5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*",
"versionStartIncluding": "1.45.0",
"versionEndExcluding": "1.45.4",
"matchCriteriaId": "439E39DA-8BB7-4AF7-9F42-E334A9B4AD3E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.46.0:rc0:*:*:*:*:*:*",
"matchCriteriaId": "D371958A-1F95-4C45-B556-B087A7274D4C"
}
]
}
]
}
],
"references": [
{
"url": "https://phabricator.wikimedia.org/T406954",
"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
"tags": [
"Permissions Required"
]
}
]
}