Wikimedia Foundation CheckUser vulnerabilities

Newest CVEs

• CVE-2026-58034

  Stored XSS through a system message when blocking a temporary account that's related to other temporary accounts

  Wikimedia Foundation · CheckUser

  None0.0
• CVE-2026-34090

  Suggested investigations: Handle suppressed usernames

  Wikimedia Foundation · CheckUser

  Medium4.8
• CVE-2025-67478

  Wrong E-Mail address composition for usernames with a comma and Umlauts in it like "Döe, Jähn"

  Wikimedia Foundation · CheckUser

  None0.0
• CVE-2025-61658

  Special:GlobalContributions shows edits on wikis the viewer doesn't have access to

  Wikimedia Foundation · CheckUser

  Low1.3
• CVE-2025-61651

  i18n XSS through Special:CheckUser CheckUser helper

  Wikimedia Foundation · CheckUser

  None0.0
• CVE-2025-61648

  Stored XSS through system messages in CheckUser

  Wikimedia Foundation · CheckUser

  None0.0
• CVE-2025-61649

  UserInfoCard: Check that performing user has permission to view log entries for number of past blocks

  Wikimedia Foundation · CheckUser

  Low1.1
• CVE-2025-61650

  UserInfoCard is vulnerable to message key stored XSS

  Wikimedia Foundation · CheckUser

  Low1.1
• CVE-2025-61647

  UserInfoCard: Don't allow access to information about users who are suppressed if you don't have suppressor rights

  Wikimedia Foundation · CheckUser

  Low0.3