CVE-2023-37252: MediaWiki CheckUser extension vulnerability

Q: Which versions should be considered during triage?

The issue is reported in the MediaWiki CheckUser extension through version 1.39.3. The provided information does not specify the first affected version or a fixed version.

Q: Are MediaWiki installations without the CheckUser extension identified as affected?

The issue is specifically identified in the CheckUser extension. The provided information does not identify installations without that extension as affected.

Published Sep 14, 2026

Updated

An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. Special:CheckUserLog shows usernames that have been hidden.

Affected Software

1 affected component

MediaWiki CheckUser extension<=1.39.3

Event History

Sep 14, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

Which versions should be considered during triage?

The issue is reported in the MediaWiki CheckUser extension through version 1.39.3. The provided information does not specify the first affected version or a fixed version.

Are MediaWiki installations without the CheckUser extension identified as affected?

The issue is specifically identified in the CheckUser extension. The provided information does not identify installations without that extension as affected.