CVE-2026-39937: Global vanishing does not completely remove user email
Improper removal of sensitive information before storage or transfer vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resource Leak Exposure. The issue has been remediated on the master branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39937?
The severity of CVE-2026-39937 is classified as a moderate vulnerability.
How do I fix CVE-2026-39937?
To fix CVE-2026-39937, users should update to the latest version of the Wikimedia Foundation MediaWiki CentralAuth Extension where the vulnerability has been remediated.
What impact does CVE-2026-39937 have on user data?
CVE-2026-39937 can lead to improper removal of user email addresses, potentially exposing sensitive information.
Which versions of the MediaWiki CentralAuth Extension are affected by CVE-2026-39937?
CVE-2026-39937 affects older versions of the Wikimedia Foundation MediaWiki CentralAuth Extension prior to the patch.
Is CVE-2026-39937 fixed in future releases of the software?
Yes, CVE-2026-39937 has been fixed in the 'master' branch and subsequent releases of the software.