CVE-2026-103440: pagetriagelist discloses suppressed reviewer usernames
Published Sep 30, 2026
·Updated
Exposure of sensitive information through data queries vulnerability in The Wikimedia Foundation MediaWiki PageTriage extension allows Information Elicitation.
This issue affects MediaWiki PageTriage extension: 1.46, 1.45, and 1.43.
Affected Software
1 affected component
Wikimedia Foundation MediaWiki PageTriage extension=1.46, =1.45, =1.43
Event History
Sep 30, 2026
CVE Published
via MITRE·05:38 PM
Data Sourced
via MITRE·05:38 PM
DescriptionWeakness
Data Sourced
via NVD·06:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
The affected software is the Wikimedia Foundation MediaWiki PageTriage extension in versions 1.46, 1.45, and 1.43.
2
What access would an attacker need?
The CVSS vector indicates that an attacker needs low-level privileges and user interaction. The vulnerability is remotely reachable with low attack complexity, but exploitation also requires the indicated attack conditions to be present.
3
What information could be exposed?
The issue allows information elicitation through data queries and can disclose suppressed reviewer usernames.