Mediawiki - CentralAuth Extension vulnerabilities

4 known vulnerabilities in Mediawiki - CentralAuth Extension from Wikimedia Foundation. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  MediaWiki CentralAuth extension: External Control of System or Configuration Setting

  CVE-2026-103442Sep 30, 2026Wikimedia Foundation

  External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43.

• 7.5 High severity

  Mediawiki - CentralAuth Extension: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-100244Sep 29, 2026Wikimedia Foundation

  Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows Excavation. This issue affects Mediawiki - CentralAuth Extension: from * before 1.46.1, 1.45.5, 1.43.10.

• 8.8 High severity

  Mediawiki - CentralAuth Extension: Improper Removal of Sensitive Information Before Storage or Transfer

  CVE-2026-39937Apr 7, 2026Wikimedia Foundation

  Improper removal of sensitive information before storage or transfer vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resource Leak Exposure. The issue has been remediated on the `master` branch, and in the release branches fo

• 8.8 High severity

  Mediawiki - CentralAuth Extension: Improper Authentication

  CVE-2025-6926Jul 3, 2025Wikimedia Foundation

  Improper Authentication vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows : Bypass Authentication.This issue affects Mediawiki - CentralAuth Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.