CVE-2025-23074: Special:EditProfile exposes the contents of profile fields marked "hidden"/friends or "friends of friends" when the privileged user isn't a friend of the user whose profile they edit(ed)

Severity: low (CVSS 2.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-01-14 · updated 2026-06-17
Weakness: CWE-200

Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - SocialProfile Extension allows Functionality Misuse.This issue affects Mediawiki - SocialProfile Extension: from 1.39.X before 1.39.11, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.

Affected products

Wikimedia Foundation Mediawiki - SocialProfile Extension: from 1.39.x before 1.39.11; from 1.41.x before 1.41.3; from 1.42.x before 1.42.2 — fixed in 1.39.11, 1.41.3, 1.42.2

How to fix

Upgrade to a fixed version: Wikimedia Foundation Mediawiki - SocialProfile Extension 1.39.11, 1.41.3, 1.42.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-23074 or the next vulnerability affects your stack