Description

An issue was discovered in the ProofreadPage extension for MediaWiki through 1.39.3. It leaks information about a suppressed user via the API and config variables.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-09-14T06:16:53.740Z",
  "pubdate": "2026-09-14T06:16:53.740Z",
  "executiveSummary": "The ProofreadPage extension for MediaWiki is susceptible to an information disclosure vulnerability affecting versions up to 1.39.3. This vulnerability allows for the unauthorized retrieval of information pertaining to suppressed (oversighted) users.\nThe flaw manifests within the extension's API and configuration variable handling, where inadequate access controls fail to redact or restrict metadata associated with suppressed identities. An attacker can leverage this exposure to reconstruct user activity or identify sensitive account details that should remain hidden from public or low-privileged view.\nThis vulnerability poses a significant risk to user privacy and platform anonymity, potentially undermining the integrity of content moderation and oversight mechanisms. Exploitation does not necessarily require administrative privileges, depending on the specific API endpoints exposed to the public. The risk profile is categorized as a failure of privacy-preserving logic within the extension, enabling unauthorized data harvesting of restricted system records.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper sanitization and filtering of user-related metadata within the ProofreadPage extension's internal data retrieval functions. When the extension interacts with MediaWiki's core API or populates configuration variables, it fails to check the 'suppressed' status of user entities effectively.\nIn MediaWiki, suppressed users (often referred to as 'oversighted' users) are intended to be completely hidden from all but the most privileged administrative roles to prevent the disclosure of PII or sensitive account lifecycle information. The ProofreadPage extension, however, processes these user objects during its data generation phase without invoking the necessary permission checks or the core redaction filters that normally obfuscate such records.\nThe exploitation flow typically involves an attacker querying the extension's API endpoints that return page-related or edit-related metadata. Because the extension improperly retrieves user objects associated with ProofreadPage content, it inadvertently includes the metadata of suppressed users in the API response payload. This occurs even when the requesting user lacks the specific 'oversight' permission typically required to view such information. Furthermore, certain global configuration variables utilized by the extension to facilitate frontend rendering can be manipulated or directly accessed, exposing cached data structures that contain the unmasked identities of suppressed users.\nThe vulnerability is present in versions through 1.39.3. It functions by circumventing the standard MediaWiki security boundaries that govern user visibility. Because the ProofreadPage extension acts as an intermediary for accessing specific MediaWiki objects, it bypasses the standard 'User::isHidden()' checks or equivalent visibility filtering mechanisms. The impact is significant, as it effectively nullifies the 'suppression' flag set by oversight administrators, allowing for the mapping of suppressed accounts, potentially revealing patterns of interaction that were explicitly intended to be scrubbed from the system's public-facing interfaces and machine-readable API responses."
}