User Data Exposure in CheckUser Extension for MediaWiki by Wikimedia
CVE-2023-37252

3.1LOW

Key Information:

Vendor

Mediawiki
Status
Checkuser
Vendor
CVE Published:
14 September 2026

What is CVE-2023-37252?

An issue in the CheckUser extension for MediaWiki has been identified where the Special:CheckUserLog functionality improperly discloses usernames that should have remained hidden. This flaw, present in versions up to 1.39.3, poses a risk to user privacy and data security, allowing unauthorized visibility of sensitive information.

Affected Version(s)

CheckUser 0 < 1.35.11

CheckUser 1.36.0 < 1.38.7

CheckUser 1.39.0 < 1.39.4

References

https://phabricator.wikimedia.org/T330968

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.