CVE-2026-103047 - Vulnerability Details - OpenCVE

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth extension allows Stored XSS. This issue affects Mediawiki - CentralAuth extension: before 1.46.1, 1.45.5, 1.43.10.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Wikimedia	Mediawiki - Centralauth Extension

No data.

No data.

References

Link	Providers
https://gerrit.wikimedia.org/r/c/1309285
https://phabricator.wikimedia.org/T244682

History

Wed, 30 Sep 2026 21:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 30 Sep 2026 20:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Wikimedia Wikimedia mediawiki - Centralauth Extension
Vendors & Products		Wikimedia Wikimedia mediawiki - Centralauth Extension

Tue, 29 Sep 2026 23:15:00 +0000

Type	Values Removed	Values Added
Description		Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth extension allows Stored XSS. This issue affects Mediawiki - CentralAuth extension: before 1.46.1, 1.45.5, 1.43.10.
Title		XSS through i18n message in CentralAuth
Weaknesses		CWE-79
References		https://gerrit.wikimedia.org/r/c/1309285 https://phabricator.wikimedia.org/T244682

MITRE

Status: PUBLISHED

Assigner: wikimedia-foundation

Published: 2026-09-29T22:59:48.502Z

Updated: 2026-09-30T20:03:40.967Z

Reserved: 2026-09-29T22:29:32.002Z

Link: CVE-2026-103047

Vulnrichment

Updated: 2026-09-30T20:03:37.132Z

NVD

Status : Awaiting Analysis

Published: 2026-09-29T23:17:22.570

Modified: 2026-09-30T21:17:07.960

Link: CVE-2026-103047

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-103047", "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "state": "PUBLISHED", "assignerShortName": "wikimedia-foundation", "dateReserved": "2026-09-29T22:29:32.002Z", "datePublished": "2026-09-29T22:59:48.502Z", "dateUpdated": "2026-09-30T20:03:40.967Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "shortName": "wikimedia-foundation", "dateUpdated": "2026-09-29T22:59:48.502Z"}, "title": "XSS through i18n message in CentralAuth", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "affected": [{"versions": [{"status": "affected", "version": "0", "lessThan": "1.46.1, 1.45.5, 1.43.10", "versionType": "semver"}], "defaultStatus": "unaffected", "vendor": "The Wikimedia Foundation", "product": "Mediawiki - CentralAuth extension", "repo": "https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/CentralAuth/+/refs/heads/master"}], "descriptions": [{"lang": "en", "value": "Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth extension allows Stored XSS.\n\nThis issue affects Mediawiki - CentralAuth extension: before 1.46.1, 1.45.5, 1.43.10.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth extension allows Stored XSS.<p>This issue affects Mediawiki - CentralAuth extension: before 1.46.1, 1.45.5, 1.43.10.</p>"}]}], "references": [{"url": "https://phabricator.wikimedia.org/T244682", "tags": ["issue-tracking"]}, {"url": "https://gerrit.wikimedia.org/r/c/1309285", "tags": ["mitigation"]}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}, "credits": [{"lang": "en", "value": "Bawolff", "type": "finder"}, {"lang": "en", "value": "SomeRandomDeveloper", "type": "remediation developer"}]}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-09-30T20:03:23.309961Z", "id": "CVE-2026-103047", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-30T20:03:40.967Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "XSS through i18n message in CentralAuth", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Bawolff"}, {"lang": "en", "type": "remediation developer", "value": "SomeRandomDeveloper"}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "affected": [{"repo": "https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/CentralAuth/+/refs/heads/master", "vendor": "The Wikimedia Foundation", "product": "Mediawiki - CentralAuth extension", "versions": [{"status": "affected", "version": "0", "lessThan": "1.46.1, 1.45.5, 1.43.10", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://phabricator.wikimedia.org/T244682", "tags": ["issue-tracking"]}, {"url": "https://gerrit.wikimedia.org/r/c/1309285", "tags": ["mitigation"]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth extension allows Stored XSS.\n\nThis issue affects Mediawiki - CentralAuth extension: before 1.46.1, 1.45.5, 1.43.10.", "supportingMedia": [{"type": "text/html", "value": "Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth extension allows Stored XSS.<p>This issue affects Mediawiki - CentralAuth extension: before 1.46.1, 1.45.5, 1.43.10.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')"}]}], "providerMetadata": {"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "shortName": "wikimedia-foundation", "dateUpdated": "2026-09-29T22:59:48.502Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-103047", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-30T20:03:23.309961Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-09-30T20:03:37.132Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-103047", "state": "PUBLISHED", "dateUpdated": "2026-09-29T22:59:48.502Z", "dateReserved": "2026-09-29T22:29:32.002Z", "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "datePublished": "2026-09-29T22:59:48.502Z", "assignerShortName": "wikimedia-foundation"}, "dataVersion": "5.2"}