What’s Vulnerable › Vulnerabilities

CVE-2026-100241: Private change tags exposed to anonymous users via revision-tags-change events

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-29 · updated 2026-09-30
• Weakness: CWE-200

Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - EventBus Extension allows Excavation. This issue affects Mediawiki - EventBus Extension: 1.47.0-alpha.

Affected products

• Wikimedia Foundation Mediawiki - EventBus Extension: 1.47.0-alpha

References

• https://gerrit.wikimedia.org/r/q/I6d79037edc771fe9a2889c543e12cf7b1296aab8
• https://phabricator.wikimedia.org/T432948

Get alerted when CVE-2026-100241 or the next vulnerability affects your stack