Is CVE-2023-37252 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-37252 being exploited in the wild.

How severe is CVE-2023-37252?

Low severity, with a CVSS score of 3.1, published 14 September 2026.

Which products and versions are affected?

Wikimedia CheckUser through 1.39.3; Wikimedia MediaWiki through 1.39.3.

Is there a fix for CVE-2023-37252?

A patch was published on 2023-06: Security patches developed for CheckUserLog API and Special:CheckUserLog across MediaWiki versions 1.35–1.40 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-37252 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2023-37252?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-37252: MediaWiki CheckUser extension information disclosure in log

CVE-2023-37252 · Severity: low · CVSS 3.1 · Published 2026-09-14

The CheckUser extension for MediaWiki failed to properly hide usernames that administrators had marked as hidden in their user blocks. Users with checkuser permissions but not suppression rights could see these hidden usernames displayed in the Special:CheckUserLog page and API, bypassing access controls intended to conceal sensitive user identities from standard audit logs. This is an information disclosure vulnerability affecting wiki administration and user privacy.

Quick answers

Is CVE-2023-37252 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-37252 being exploited in the wild.
How severe is CVE-2023-37252?: Low severity, with a CVSS score of 3.1, published 14 September 2026.
Which products and versions are affected?: Wikimedia CheckUser through 1.39.3; Wikimedia MediaWiki through 1.39.3.
Is there a fix for CVE-2023-37252?: A patch was published on 2023-06: Security patches developed for CheckUserLog API and Special:CheckUserLog across MediaWiki versions 1.35–1.40 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-37252 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2023-37252?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an information disclosure (CWE-200) in the CheckUser extension where the Special:CheckUserLog page and CheckUserLog API endpoints failed to apply proper access controls when displaying log entries containing usernames marked as hidden. The root cause was insufficient filtering of hidden usernames before display to users with checkuser rights but without the suppress privilege. An authenticated user with checkuser permissions could access the log and view hidden usernames by scrolling through unfiltered logs or querying the API. While the log did not auto-suggest hidden usernames, they were still visible in the actual log output. Patches were developed and deployed across multiple MediaWiki versions (1.35 through 1.40+) to filter hidden usernames from display.

Affected products

Wikimedia CheckUser through 1.39.3
Wikimedia MediaWiki through 1.39.3

Timeline

2023-03-02: disclosed: Vulnerability discovered and reported to Wikimedia security
2023-06: patched: Security patches developed for CheckUserLog API and Special:CheckUserLog across MediaWiki versions 1.35–1.40

References

https://phabricator.wikimedia.org/T330968

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.