Vulnerability · Published Sep 30, 2026 · Assigned by wikimedia-foundation

CVE-2026-103440pagetriagelist discloses suppressed reviewer usernames

Low 1.2

In plain English

A low-severity security flaw in MediaWiki PageTriage extension from The Wikimedia Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 4.0)1.2Low

Exploit odds (30 days)0.3%top 80.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Exposure of sensitive information through data queries vulnerability in The Wikimedia Foundation MediaWiki PageTriage extension allows Information Elicitation. This issue affects MediaWiki PageTriage extension: 1.46, 1.45, and 1.43.

Affected products (as reported)

Vendor	Product	Versions
The Wikimedia Foundation	MediaWiki PageTriage extension	1.461.451.43

Weakness: CWE-202 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber

In plain English

Official description

Affected products (as reported)

References