CVE-2026-100379

Received Received - Intake

Exposure of Sensitive Information in Wikipedia Android App

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: wikimedia-foundation

Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Wikipedia Android App allows Accessing/Intercepting/Modifying HTTP Cookies. This issue affects Wikipedia Android App: main.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-100379

Affected Vendors & Products

Vendor	Product	Version / Range
wikimedia_foundation	wikipedia_android_app	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability in the Wikimedia Foundation Wikipedia Android App allows an unauthorized actor to access, intercept, or modify HTTP cookies. This could lead to exposure of sensitive user information stored in those cookies.

Detection Guidance

This vulnerability involves exposure of sensitive information via HTTP cookies in the Wikipedia Android App. To detect it, monitor network traffic for unencrypted HTTP requests or responses containing cookies. Use tools like Wireshark or tcpdump to capture traffic and inspect for cookie data transmitted in plaintext. Check app logs for any warnings about insecure cookie handling.

Impact Analysis

An attacker could steal session cookies to impersonate you on the app, access your account without credentials, or modify cookies to alter app behavior. This may lead to unauthorized access to your personal data or account.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by exposing sensitive user data. Organizations using the app may face compliance failures, legal penalties, or reputational damage due to unauthorized data access.

Mitigation Strategies

Update the Wikipedia Android App to the latest version immediately. Avoid using untrusted networks for sensitive activities. Monitor network traffic for unusual cookie modifications or interceptions.

Hi! I’m here to help you understand CVE-2026-100379. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70