CVE-2026-103440: pagetriagelist discloses suppressed reviewer usernames

Published Sep 30, 2026

Updated

Exposure of sensitive information through data queries vulnerability in The Wikimedia Foundation MediaWiki PageTriage extension allows Information Elicitation.

This issue affects MediaWiki PageTriage extension: 1.46, 1.45, and 1.43.

Affected Software

1 affected component

Wikimedia Foundation MediaWiki PageTriage extension=1.46, =1.45, =1.43

Event History

Sep 30, 2026

CVE Published

via MITRE·05:38 PM

Data Sourced

via MITRE·05:38 PM

DescriptionWeakness

Data Sourced

via NVD·06:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

The affected software is the Wikimedia Foundation MediaWiki PageTriage extension in versions 1.46, 1.45, and 1.43.

What access would an attacker need?

The CVSS vector indicates that an attacker needs low-level privileges and user interaction. The vulnerability is remotely reachable with low attack complexity, but exploitation also requires the indicated attack conditions to be present.

What information could be exposed?

The issue allows information elicitation through data queries and can disclose suppressed reviewer usernames.

CVE-2026-103440: pagetriagelist discloses suppressed reviewer usernames

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What access would an attacker need?

What information could be exposed?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access would an attacker need?

What information could be exposed?