Description

An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. Special:CheckUserLog shows usernames that have been hidden.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-09-14T05:16:57.580Z",
  "pubdate": "2026-09-14T05:16:57.580Z",
  "executiveSummary": "The CheckUser extension for MediaWiki contains an information disclosure vulnerability affecting versions up to and including 1.39.3. This security flaw resides within the Special:CheckUserLog interface, which fails to correctly apply visibility restrictions to log entries. Consequently, usernames that have been administratively hidden are rendered visible to unauthorized users viewing the logs.\nThis vulnerability is classified as an improper authorization flaw, leading to sensitive data exposure. The impact allows unauthorized parties to deanonymize users who are intended to be hidden from the platform's public or restricted logs. This poses significant privacy risks for users relying on administrative concealment features. Exploitation does not require advanced access levels, as it involves the interaction with existing, publicly accessible log interfaces within the MediaWiki installation. The risk is elevated in environments where user privacy and anonymity are enforced through administrative controls, as the exposure of these hidden identities directly undermines the security and policy enforcement mechanisms of the MediaWiki installation.",
  "technicalDetails": "The vulnerability is localized within the Special:CheckUserLog component of the CheckUser extension. The core issue is a failure in the logical implementation responsible for filtering log entries based on user metadata and administrative suppression flags. In MediaWiki, administrative actions allow for the suppression or hiding of usernames from specific logs to protect user identity and maintain privacy during investigative or punitive actions.\nThe root cause is an insecure authorization check during the rendering process of the Special:CheckUserLog query result set. When the extension queries the database for log entries, it retrieves the audit trail associated with CheckUser activities; however, the subsequent display logic fails to evaluate the 'deleted' or 'hidden' flags assigned to specific usernames. Specifically, the extension’s internal API or display function does not check the 'rev_deleted' or equivalent field in the logging database table before outputting the username string to the HTML response.\nThe attack flow is straightforward: an attacker accesses the Special:CheckUserLog page on an affected MediaWiki installation. No specialized authentication or high-level privilege is typically required to view log headers if the interface is accessible to the user group in question. As the server processes the log query, it iterates through the relevant database entries and directly passes the username strings into the rendering pipeline without performing an authorization verification against the visibility status of the specific account.\nAs a result, the browser receives and renders the list of usernames including those that should have been suppressed, effectively bypassing the platform's privacy controls. This leads to the exposure of hidden identities. The vulnerability is present in the MediaWiki CheckUser extension versions up to 1.39.3. The exposure is persistent as long as the underlying logging data exists and the affected code remains in place, allowing any user with access to view logs to reconstruct a history of hidden activities or identify accounts that were explicitly hidden from public view by administrators.\nThe exploitation does not rely on complex payloads or secondary vulnerabilities (such as SQL injection); it is a purely logical flaw in the access control implementation of the log reporting module. The post-exploitation impact is the complete loss of privacy for hidden accounts, potentially leading to social engineering, harassment, or the discovery of administrative investigative efforts."
}