The Wikimedia Foundation CheckUser vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting The Wikimedia Foundation CheckUser: 9 record(s), with affected versions and fixes.
CVE-2026-58034
Medium · 4.8
CWE-79 Jul 1, 2026
Stored XSS through a system message when blocking a temporary account that's related to other temporary accounts
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser.
This vulnerability is associated with program files modules/ext.CheckUser.TempAccounts/components/blockConnectedTempAccountsField.Vue.
This issue affects CheckUser: from 1.46.0-rc.0 before 1.46.0.
CVE-2026-34090
High · 7.5
CWE-200 May 11, 2026
Suggested investigations: Handle suppressed usernames
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation CheckUser.
This issue affects CheckUser: from 1.45.0 before 1.45.2.
CVE-2025-67478
High · 8.8
Feb 2, 2026
Wrong E-Mail address composition for usernames with a comma and Umlauts in it like "Döe, Jähn"
Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files includes/Mail/UserMailer.Php.
This issue affects CheckUser: from * before 1.39.14, 1.43.4, 1.44.1.
CVE-2025-61658
Medium · 4.3
CWE-22 Feb 2, 2026
Special:GlobalContributions shows edits on wikis the viewer doesn't have access to
Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files src/GlobalContributions/GlobalContributionsPager.Php.
This issue affects CheckUser: from * before 1.43.4, 1.44.1.
CVE-2025-61651
Medium · 6.1
CWE-79 Feb 2, 2026
i18n XSS through Special:CheckUser CheckUser helper
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files modules/ext.CheckUser/checkuser/checkUserHelper/buildUserElement.Js.
This issue affects CheckUser: from * before 1.44.1.
CVE-2025-61650
Low · 1.1
CWE-79 Feb 2, 2026
UserInfoCard is vulnerable to message key stored XSS
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files src/Services/CheckUserUserInfoCardService.Php.
This issue affects CheckUser: from * before 795bf333272206a0189050d975e94b70eb7dc507.
CVE-2025-61649
Low · 1.1
CWE-22 Feb 2, 2026
UserInfoCard: Check that performing user has permission to view log entries for number of past blocks
Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files src/Services/CheckUserUserInfoCardService.Php.
This issue affects CheckUser: from 7cedd58781d261f110651b6af4f41d2d11ae7309.
CVE-2025-61648
Medium · 6.1
CWE-79 Feb 2, 2026
Stored XSS through system messages in CheckUser
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files modules/ext.CheckUser.TempAccounts/components/ShowIPButton.Vue, modules/ext.CheckUser.TempAccounts/SpecialBlock.Js.
This issue affects CheckUser: from * before 1.44.1.
CVE-2025-61647
Low · 0.4
CWE-22 Feb 2, 2026
UserInfoCard: Don't allow access to information about users who are suppressed if you don't have suppressor rights
Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files src/Api/Rest/Handler/UserInfoHandler.Php.
This issue affects CheckUser: from a3dc1bbcc33acbcca6831d6afaccbb1054c93a57, 0584eb2ad564648aa3ce9c555dd044dda02b55f4.