Vulnerability · Published Apr 7, 2026 · Assigned by wikimedia-foundation

CVE-2026-39937Global vanishing does not completely remove user email

High 8.8

In plain English

A high-severity security flaw in Mediawiki - CentralAuth Extension from The Wikimedia Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 4.0)8.8High

Exploit odds (30 days)0.3%top 80.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper removal of sensitive information before storage or transfer vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resource Leak Exposure. The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.

Affected products (as reported)

Vendor	Product	Versions
The Wikimedia Foundation	Mediawiki - CentralAuth Extension	0 – before 1.43

Weakness: CWE-212 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L

In plain English

Official description

Affected products (as reported)

References