Executive brief
A vulnerability in the GrowthExperiments extension for MediaWiki can cause servers to enter an infinite loop when processing mentor reassignments. This occurs when a mentor has 'hidden' mentees, leading the system to repeatedly schedule background tasks that never complete. This can result in excessive resource consumption and potential service degradation for the affected wiki.
Technical details
A logic error in the GrowthExperiments extension's ReassignMenteesJob component leads to an infinite loop (CWE-835). The vulnerability is triggered when a mentor with 'hidden' mentees (accounts hidden by an oversighter) resigns. The job checks for remaining mentees using MentorStore::hasAnyMentees(), which includes hidden users, but the subsequent retrieval method MentorStore::getMenteesByMentor() ignores them by default. This discrepancy causes the job to believe work remains and continuously reschedule itself without ever processing the hidden users. This issue has been remediated in versions 1.43.7, 1.44.4, and 1.45.2.
Affected products
- The Wikimedia Foundation Mediawiki - GrowthExperiments Extension 1.43.x before 1.43.7, 1.44.x before 1.44.4, 1.45.x before 1.45.2
Timeline
- 2026-02-24: disclosed: Issue discovered and reported internally via Phabricator.
- 2026-04-07: advisory: CVE-2026-39934 published.
- 2026-04-07: patched: Remediated versions 1.43.7, 1.44.4, and 1.45.2 released.