CVE-2026-5266
Publication date 11 May 2026
Last updated 10 July 2026
Ubuntu priority
Description
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Echo. This vulnerability is associated with program files includes/Api/ApiEchoNotifications.Php. This issue affects Echo: from * before 1.43.7, 1.44.4, 1.45.2.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| mediawiki | 26.04 LTS resolute |
Needs evaluation
|
| 24.04 LTS noble |
Needs evaluation
|
|
| 22.04 LTS jammy |
Needs evaluation
|
|
| 20.04 LTS focal |
Needs evaluation
|
|
| 18.04 LTS bionic |
Needs evaluation
|
Severity score breakdown
CVSS version: CVSS v4.0
Base score
2.3 · Low
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
References
Other references
- https://www.cve.org/CVERecord?id=CVE-2026-5266
- http://phabricator.wikimedia.org/T420154
- https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Echo/+/1265622 (REL1_43)
- https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Echo/+/1265608 (master)
- https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/DIBLSBHISKX6NFRUFNOGZRVW42E7R2QP/