Mediawiki Checkuser vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Mediawiki Checkuser: 6 record(s), with affected versions and fixes.cpe:2.3:a:mediawiki:checkuser
CVE-2023-37252
Low · 3.1
CWE-669 Sep 14, 2026
Incorrect Resource Transfer Between Spheres in Mediawiki Checkuser
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. Special:CheckUserLog shows usernames that have been hidden.
CVE-2026-34090
High · 7.5
CWE-200 May 11, 2026
Suggested investigations: Handle suppressed usernames
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation CheckUser.
This issue affects CheckUser: from 1.45.0 before 1.45.2.
CVE-2025-67478
High · 8.8
Feb 2, 2026
Wrong E-Mail address composition for usernames with a comma and Umlauts in it like "Döe, Jähn"
Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files includes/Mail/UserMailer.Php.
This issue affects CheckUser: from * before 1.39.14, 1.43.4, 1.44.1.
CVE-2025-61658
Medium · 4.3
CWE-22 Feb 2, 2026
Special:GlobalContributions shows edits on wikis the viewer doesn't have access to
Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files src/GlobalContributions/GlobalContributionsPager.Php.
This issue affects CheckUser: from * before 1.43.4, 1.44.1.
CVE-2025-61651
Medium · 6.1
CWE-79 Feb 2, 2026
i18n XSS through Special:CheckUser CheckUser helper
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files modules/ext.CheckUser/checkuser/checkUserHelper/buildUserElement.Js.
This issue affects CheckUser: from * before 1.44.1.
CVE-2025-61648
Medium · 6.1
CWE-79 Feb 2, 2026
Stored XSS through system messages in CheckUser
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files modules/ext.CheckUser.TempAccounts/components/ShowIPButton.Vue, modules/ext.CheckUser.TempAccounts/SpecialBlock.Js.
This issue affects CheckUser: from * before 1.44.1.