CVE-2025-61646 Watchlist group mode reveals authors of edits with hidden authorship
Attackers can view authors of edits marked as hidden in MediaWiki watchlist group mode, exposing private user data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-61646?
CVE-2025-61646 is a low-severity vulnerability in Mediawiki Mediawiki, published on 3 Feb 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/RecentChanges/EnhancedChangesList.Php.
This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.
Weakness: CWE-22
Which versions are affected by CVE-2025-61646?
It affects 1 product.
Products include Mediawiki Mediawiki.
How do I fix CVE-2025-61646?
Upgrade to a fixed version.
Is CVE-2025-61646 being exploited?
There is no known exploitation of CVE-2025-61646 in the wild and no public exploit code.
Other vulnerabilities in Mediawiki Mediawiki
Sources
Also known as DEBIAN-CVE-2025-61646, GHSA-v564-5h76-v6ch, UBUNTU-CVE-2025-61646.