CVE-2019-18611 Information disclosure in n/a
Users with CheckUser access could view sensitive oversighted edit summaries via the API, exposing hidden data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-18611?
CVE-2019-18611 is a medium-severity vulnerability in n/a, published on 29 Oct 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue was discovered in the CheckUser extension through 1.34 for MediaWiki. Certain sensitive information within oversighted edit summaries made available via the MediaWiki API was potentially visible to users with various levels of access to this extension. Said users should not have been able to view these oversighted edit summaries via the MediaWiki API.
Weakness: CWE-200
Which versions are affected by CVE-2019-18611?
It affects 1 product.
Products include Mediawiki Checkuser.
How do I fix CVE-2019-18611?
No fix has been published for CVE-2019-18611 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-18611 being exploited?
There is no known exploitation of CVE-2019-18611 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2015-2940 Cross-site request forgery in n/a
- CVE-2019-16529 Information disclosure in n/a
- CVE-2026-34090 Suggested investigations: Handle suppressed usernames
- CVE-2025-61658 Special:GlobalContributions shows edits on wikis the viewer doesn't have access to
- CVE-2025-61648 Stored XSS through system messages in CheckUser
Sources
Also known as GHSA-w3xh-g4rp-pcfc.