What’s Vulnerable › Vulnerabilities

CVE-2025-61647: UserInfoCard: Don't allow access to information about users who are suppressed if you don't have suppressor rights

• Severity: low (CVSS 0.4 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-03 · updated 2026-06-17
• Weakness: CWE-22

Description

Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files src/Api/Rest/Handler/UserInfoHandler.Php. This issue affects CheckUser: from a3dc1bbcc33acbcca6831d6afaccbb1054c93a57, 0584eb2ad564648aa3ce9c555dd044dda02b55f4.

Affected products

• Wikimedia Foundation CheckUser: from a3dc1bbcc33acbcca6831d6afaccbb1054c93a57, 0584eb2ad564648aa3ce9c555dd044dda02b55f4

References

• https://phabricator.wikimedia.org/T399093

Get alerted when CVE-2025-61647 or the next vulnerability affects your stack