CVE-2025-61639 Suppressed blocked IP is visible in Special:BlockList, RC, and other places
Attackers can view suppressed blocked IP addresses in MediaWiki logs and recent changes, exposing sensitive user data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-61639?
CVE-2025-61639 is a low-severity vulnerability in Mediawiki Mediawiki, published on 2 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/logging/ManualLogEntry.Php, includes/recentchanges/RecentChangeFactory.Php, includes/recentchanges/RecentChangeStore.Php.
This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.
Weakness: CWE-200
Which versions are affected by CVE-2025-61639?
It affects 1 product.
Products include Mediawiki Mediawiki.
How do I fix CVE-2025-61639?
Upgrade to a fixed version.
Is CVE-2025-61639 being exploited?
There is no known exploitation of CVE-2025-61639 in the wild and no public exploit code.
Other vulnerabilities in Mediawiki Mediawiki
Sources
Also known as DEBIAN-CVE-2025-61639, GHSA-62j4-5x45-jvf3, UBUNTU-CVE-2025-61639.