CVE-2025-6589 - With MultiBlocks enabled and a user who is suppressed via a MultiBlock, a user without 'hideuser' can see the hidden username in the BlockList

Back Back to CVE browser

LOW

With MultiBlocks enabled and a user who is suppressed via a MultiBlock, a user without 'hideuser' can see the hidden username in the BlockList

Published Feb 2, 2026

2.1

LOW

CVSS 4.0

EPSS 0.49%

Description

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/specials/pagers/BlockListPager.Php.

This issue affects MediaWiki: >= 1.42.0.

Affected products

Vendor Wikimedia Foundation Product MediaWiki Default
unaffected
- Version
  >= 1.42.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Wikimedia Foundation

MediaWiki

unaffected

Version	Status	Constraints
>= 1.42.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-206630		Advisory
https://phabricator.wikimedia.org/T391343

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner wikimedia-foundation

Published Feb 2, 2026

Updated Mar 3, 2026

Reserved Jun 24, 2025

Link CVE-2025-6589

CISA Vulnrichment

Updated Feb 3, 2026

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2025-6589

Red Hat

Severity n/a

Public date n/a

Links CVE-2025-6589

ENISA EUVD

Assigner wikimedia-foundation

Published Feb 2, 2026

Updated Mar 3, 2026

Exploited since n/a

Link EUVD-2025-206630

EUVD-2025-206630