CVE-2026-5266
Exposure of Sensitive Information in Wikimedia Echo
Publication date: 2026-05-11
Last updated on: 2026-05-11
Assigner: wikimedia-foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wikimedia | echo | From 1.43.0 (inc) to 1.43.7 (exc) |
| wikimedia | echo | 1.44.4 |
| wikimedia | echo | 1.45.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allowed unauthorized access to user notifications, which could contain private information such as email subject lines or thanks. Exposure of such sensitive information to unauthorized actors can lead to non-compliance with data protection regulations like GDPR and HIPAA, which mandate strict controls over personal and sensitive data access.
By enabling any OAuth tool or BotPassword to access notifications without specific permissions, the vulnerability risked violating principles of least privilege and data confidentiality required by these standards.
The issue was mitigated by introducing a new user right "echo-read-notifications" to restrict access to authorized tools only, helping to restore compliance with such regulations by enforcing proper access controls.
Can you explain this vulnerability to me?
CVE-2026-5266 is a security vulnerability in the MediaWiki Notifications (Echo) API that allowed any OAuth tool or BotPassword to access a user's notifications without requiring specific permissions.
This posed a risk because notifications could contain private information such as email subject lines or thanks.
The issue was fixed by introducing a new user right called "echo-read-notifications," which restricts access to notifications to authorized tools only.
How can this vulnerability impact me? :
This vulnerability could allow unauthorized OAuth tools or BotPasswords to read your private notifications, potentially exposing sensitive information such as email subject lines or personal acknowledgments.
Such unauthorized access could lead to privacy breaches and misuse of your personal or account-related information.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that your MediaWiki Echo extension is updated to a patched version where the fix has been applied (versions 1.43.7, 1.44.4, 1.45.2 or later).
Apply the patch that introduces the new user right "echo-read-notifications" which restricts access to notifications only to authorized OAuth tools or BotPasswords.
Verify that any OAuth tools or BotPasswords accessing notifications have been granted the "echo-read-notifications" permission explicitly.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves unauthorized access to user notifications via OAuth tools or BotPasswords without proper permissions.
To detect if your system is vulnerable, you should check whether any OAuth tools or BotPasswords are accessing the Echo notifications API without the new "echo-read-notifications" user right.
You can audit your MediaWiki logs for API calls to the Echo notifications endpoint (e.g., includes/Api/ApiEchoNotifications.Php) and verify the permissions of the requesting clients.
- Use MediaWiki's logging or access logs to identify API requests to the Echo notifications endpoint.
- Check OAuth tool or BotPassword permissions to confirm if they have the "echo-read-notifications" right.
- Example command to search logs for Echo API access (adjust path and log file as needed):
grep 'ApiEchoNotifications' /var/log/mediawiki/access.log
- Review the output to identify unauthorized access attempts.
- Additionally, verify your MediaWiki version and ensure it is updated to a patched version (1.43.7, 1.44.4, 1.45.2 or later) where this vulnerability is fixed.