Advisories · Technology

The Wikimedia Foundation MediaWiki CentralAuth extension.

Every CVE that names The Wikimedia Foundation MediaWiki CentralAuth extension among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-103442 CVE record

CVSS 7.2 High

MergeAccount PHP object injection via session-key substitution
- The Wikimedia Foundation MediaWiki CentralAuth extension
- CWE-15
Not analysed yet 30 Sept 2026
CVE-2026-103047 CVE record

CVSS 6.1 Medium

XSS through i18n message in CentralAuth
- The Wikimedia Foundation Mediawiki - CentralAuth extension
- Cross-site scripting (XSS)
Not analysed yet 29 Sept 2026
CVE-2026-39937 CVE record

CVSS 8.8 High

Global vanishing does not completely remove user email
- The Wikimedia Foundation Mediawiki - CentralAuth Extension
- CWE-212
Not analysed yet 7 Apr 2026
CVE-2025-62669 CVE record

CVSS 6.9 Medium

UserInfoCard: activeLocalBlocksAllWikis does not do permissions checks
- The Wikimedia Foundation Mediawiki - CentralAuth Extension
- Information disclosure
Not analysed yet 18 Oct 2025