CVE-2026-58036: Users API leaks whether privileged users have their user groups disabled for lack of 2FA
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.
This vulnerability is associated with program files includes/Api/ApiQueryAllUsers.Php, includes/Api/ApiQueryUsers.Php, includes/Permissions/PermissionManager.Php, includes/User/UserGroupManager.Php.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58036?
CVE-2026-58036 has a severity rating of low with a CVSS score of 4.0.
What does CVE-2026-58036 expose?
CVE-2026-58036 exposes whether privileged users have their user groups disabled due to the lack of two-factor authentication.
Which systems are affected by CVE-2026-58036?
CVE-2026-58036 affects Wikimedia Foundation MediaWiki software.
How can I mitigate the risk of CVE-2026-58036?
To mitigate the risk of CVE-2026-58036, ensure that two-factor authentication is enabled for privileged users.
What components are involved in CVE-2026-58036?
CVE-2026-58036 involves program files such as ApiQueryAllUsers.Php, ApiQueryUsers.Php, and PermissionManager.Php.