Is CVE-2026-58034 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-58034 being exploited in the wild.

How severe is CVE-2026-58034?

Informational severity, with a CVSS score of 0, published 1 July 2026.

Which products and versions are affected?

Wikimedia Foundation CheckUser 1.46.0-rc.0 to 1.46.0.

Is there a fix for CVE-2026-58034?

A patch was published on 2026-07-01: Fixed in version 1.46.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-58034 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-58034?

Check whether you run Wikimedia Foundation CheckUser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58034: Wikimedia Foundation CheckUser XSS in blockConnectedTempAccountsField

CVE-2026-58034 · Severity: info · CVSS 0 · Published 2026-07-01

A security vulnerability exists in the Wikimedia CheckUser extension, a tool used by wiki administrators to investigate disruptive behavior and sockpuppetry. This flaw could allow a malicious actor to execute unauthorized scripts in the browser of another user, potentially leading to the theft of session information or unauthorized actions. The impact is limited as it requires high-level administrative privileges and specific user interaction to trigger.

Technologies: Wikimedia Foundation CheckUser. Vendors: Wikimedia Foundation.

Quick answers

Is CVE-2026-58034 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-58034 being exploited in the wild.
How severe is CVE-2026-58034?: Informational severity, with a CVSS score of 0, published 1 July 2026.
Which products and versions are affected?: Wikimedia Foundation CheckUser 1.46.0-rc.0 to 1.46.0.
Is there a fix for CVE-2026-58034?: A patch was published on 2026-07-01: Fixed in version 1.46.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58034 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-58034?: Check whether you run Wikimedia Foundation CheckUser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in the Wikimedia Foundation CheckUser extension within the 'blockConnectedTempAccountsField.Vue' component. The root cause is improper neutralization of input during web page generation, specifically affecting the temporary accounts module. An attacker with high privileges (PR:H) could potentially inject malicious scripts that execute when an administrative user interacts with the affected UI component. The vulnerability was identified in version 1.46.0-rc.0 and is addressed in version 1.46.0.

Affected products

Wikimedia Foundation CheckUser 1.46.0-rc.0 to 1.46.0

Timeline

2026-07-01: advisory: CVE-2026-58034 published by Wikimedia Foundation
2026-07-01: patched: Fixed in version 1.46.0

References

https://phabricator.wikimedia.org/T428820

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.