{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/wikimedia-foundation/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MediaWiki"],"_cs_severities":["medium"],"_cs_tags":["information-disclosure","mediawiki","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Wikimedia Foundation"],"content_html":"\u003cp\u003eA vulnerability in MediaWiki's RESTBase-compatible revision response allows for the unauthenticated disclosure of numeric user IDs associated with hidden revision authors. While the \u003ccode\u003euser_text\u003c/code\u003e field is correctly set to \u003ccode\u003enull\u003c/code\u003e and the author is marked as hidden in the API response, the underlying numeric user ID remains exposed. This ID can be cross-referenced against the public MediaWiki user lookup API to de-anonymize the author of a hidden revision. The vulnerability affects instances where the core REST revision route is exposed and the RESTBase-compatible response format is utilized. The issue was disclosed by researcher Marco Paciaroni (BomboBombone) and tracked in the MediaWiki Phabricator system under task T434521. Defenders should assess exposure of their REST API endpoints and verify patch status for affected MediaWiki versions.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows an unauthenticated actor to bypass privacy controls intended to hide revision history. By mapping the leaked numeric user ID to a public username, attackers can de-anonymize contributors who have requested privacy via the 'suppressrevision' feature. This impacts organizations relying on MediaWiki for internal or public documentation where author attribution requires strict privacy controls.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor web access logs for unusual patterns of sequential requests to MediaWiki REST revision endpoints and subsequent requests to user lookup APIs.\u003c/li\u003e\n\u003cli\u003eAudit MediaWiki configurations to restrict access to the REST revision route if it is not required for public-facing operations.\u003c/li\u003e\n\u003cli\u003eApply the vendor-provided patch associated with Phabricator task T434521 immediately.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-30T16:32:55Z","date_published":"2026-09-30T16:32:55Z","id":"https://feed.craftedsignal.io/briefs/2026-09-mediawiki-info-disclosure/","summary":"MediaWiki is susceptible to an information disclosure flaw where the RESTBase-compatible API exposes the numeric user ID of hidden revision authors, allowing unauthenticated attackers to map IDs to usernames.","title":"MediaWiki RESTBase Information Disclosure Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-09-mediawiki-info-disclosure/"}],"language":"en","title":"CraftedSignal Threat Feed - Wikimedia Foundation","version":"https://jsonfeed.org/version/1.1"}