Executive brief
The CheckUser extension for MediaWiki failed to properly hide usernames that administrators had marked as hidden in their user blocks. Users with checkuser permissions but not suppression rights could see these hidden usernames displayed in the Special:CheckUserLog page and API, bypassing access controls intended to conceal sensitive user identities from standard audit logs. This is an information disclosure vulnerability affecting wiki administration and user privacy.
Technical details
The vulnerability is an information disclosure (CWE-200) in the CheckUser extension where the Special:CheckUserLog page and CheckUserLog API endpoints failed to apply proper access controls when displaying log entries containing usernames marked as hidden. The root cause was insufficient filtering of hidden usernames before display to users with checkuser rights but without the suppress privilege. An authenticated user with checkuser permissions could access the log and view hidden usernames by scrolling through unfiltered logs or querying the API. While the log did not auto-suggest hidden usernames, they were still visible in the actual log output. Patches were developed and deployed across multiple MediaWiki versions (1.35 through 1.40+) to filter hidden usernames from display.
Affected products
- Wikimedia CheckUser through 1.39.3
- Wikimedia MediaWiki through 1.39.3
Timeline
- 2023-03-02: disclosed: Vulnerability discovered and reported to Wikimedia security
- 2023-06: patched: Security patches developed for CheckUserLog API and Special:CheckUserLog across MediaWiki versions 1.35–1.40