CVE-2026-100244: CentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669)
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows Excavation.
This issue affects Mediawiki - CentralAuth Extension: from before 1.46.1, 1.45.5, 1.43.10.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MediaWiki CentralAuth Extensionto a version that resolves this vulnerability.Fixed in 1.46.1 - Upgrade
Upgrade
MediaWiki CentralAuth Extensionto a version that resolves this vulnerability.Fixed in 1.45.5 - Upgrade
Upgrade
MediaWiki CentralAuth Extensionto a version that resolves this vulnerability.Fixed in 1.43.10
Event History
Frequently Asked Questions
Which CentralAuth versions require remediation?
The issue affects versions earlier than 1.46.1, 1.45.5, and 1.43.10. Upgrade to the applicable fixed release in the supported branch.
Where could the information be exposed?
Locally suppressed block information may be exposed through the globaluserinfo API and Special:CentralAuth. These interfaces should be considered when assessing potential disclosure.