CVE-2025-67478: Wrong E-Mail address composition for usernames with a comma and Umlauts in it like "Döe, Jähn"
Published Feb 3, 2026
·Updated
Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files includes/Mail/UserMailer.Php.
This issue affects CheckUser: from before 1.39.14, 1.43.4, 1.44.1.
Affected Software
4 affected components
Wikimedia Foundation CheckUser<1.39.14
MediaWiki Checkuser Mediawiki>=1.39.0<1.39.14
MediaWiki Checkuser Mediawiki>=1.43.0<1.43.4
MediaWiki Checkuser Mediawiki=1.44.0
Event History
Feb 3, 2026
CVE Published
via MITRE·01:14 AM
Data Sourced
via MITRE·01:14 AM
Description
Data Sourced
via NVD·02:16 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-67478?
CVE-2025-67478 has a moderate severity due to potential email address composition issues affecting communication.
2
How do I fix CVE-2025-67478?
To fix CVE-2025-67478, upgrade Wikimedia Foundation CheckUser to version 1.39.14 or later.
3
Which versions of CheckUser are affected by CVE-2025-67478?
CVE-2025-67478 affects CheckUser versions prior to 1.39.14, 1.43.4, and 1.44.1.
4
What type of vulnerability is CVE-2025-67478?
CVE-2025-67478 is a input validation vulnerability related to email address formatting.
5
What impact does CVE-2025-67478 have on users?
CVE-2025-67478 can lead to incorrect email notifications for usernames containing commas and Umlauts.