CVE-2026-58029

Published: Jul 1, 2026Modified: Jul 9, 2026

5.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (Secondary)

Description

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiChangeAuthenticationData.Php, includes/Api/ApiLinkAccount.Php, includes/Api/ApiRemoveAuthenticationData.Php, includes/Specials/SpecialLinkAccounts.Php, includes/Specials/SpecialUnlinkAccounts.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

Affected (4)

Products: Mediawiki: Mediawiki

Mediawiki

1 product

Mediawiki

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Mediawiki Mediawiki	From 1.43.0 to 1.43.9
Mediawiki Mediawiki	From 1.44.0 to 1.44.6
Mediawiki Mediawiki	From 1.45.0 to 1.45.4
Mediawiki Mediawiki	Version 1.46.0 rc0

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (1)

https://phabricator.wikimedia.org/T422676

Source: c4f26cc8-17ff-4c99-b5e2-38fc1793eacc

Permissions Required

Timeline

No history available yet.