Executive brief
A vulnerability in the CentralAuth extension for MediaWiki prevents the complete removal of user data when an account is 'vanished' (deleted). While the system claims to delete sensitive information like email addresses, this data may persist in individual database tables across different wiki sites. This could lead to the unintended retention of private user information, potentially violating privacy policies or data protection regulations like GDPR.
Technical details
A vulnerability exists in the CentralAuth extension where the 'account vanishing' (deletion) process fails to propagate the removal of sensitive data to local wiki databases. Specifically, while the `gu_email` field is cleared in the `globaluser` table, the `GlobalRenameUser::getJob` function fails to pass the 'vanish' type option to `LocalRenameUserJob`. Consequently, the local jobs default to a standard rename operation, leaving the `user_email` and potentially password hashes intact in local `user` tables. This results in an information leak where sensitive PII remains in the database despite the system indicating it has been removed. The issue is fixed by ensuring the 'type' option is correctly forwarded to trigger the system user 'steal' path, which properly scrubs local credentials.
Affected products
- The Wikimedia Foundation MediaWiki - CentralAuth Extension < 1.43, 1.43.x < 1.43.7, 1.44.x < 1.44.4, 1.45.x < 1.45.2
Timeline
- 2026-02-23: other: Vulnerability discovered and reported internally
- 2026-04-07: disclosed: CVE published
- 2026-04-07: patched: Remediated in master and release branches 1.43, 1.44, and 1.45