Register for the AI for Security Summit: Join Figma, Perplexity & Wiz

CVE-2025-6592
Linux Debian vulnerability analysis and mitigation

Overview

CVE-2025-6592 is an improper access control vulnerability in the Wikimedia Foundation's AbuseFilter MediaWiki extension, specifically associated with the includes/auth/AuthManager.php file. It affects AbuseFilter versions from commit fe0b1cb9e9691faf4d8d9bd80646589f6ec37615 up to (but not including) 1.43.2 and 1.44.0. The vulnerability was published on February 2, 2026, and has a CVSS v4.0 base score of 2.1 (Low), though Feedly estimates its category as High severity (Red Hat CVE).

Technical details

The vulnerability is classified as CWE-284 (Improper Access Control) and resides in the AuthManager.php file within the AbuseFilter extension. An authenticated attacker with high privileges can exploit this flaw under specific attack conditions (attack requirements: PRESENT) to bypass authentication checks within the AbuseFilter module. The network-based attack vector requires no user interaction, but the presence of specific preconditions limits its exploitability (Red Hat CVE).

Impact

Successful exploitation allows an attacker to circumvent AbuseFilter's abuse detection mechanisms, potentially enabling spam, vandalism, or other malicious wiki activities to go undetected. The impact is limited to a low confidentiality disclosure in both the vulnerable and subsequent system scopes, with no integrity or availability impact. The vulnerability does not enable remote code execution or privilege escalation beyond bypassing the filtering layer (Red Hat CVE).

Exploitability

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-6592. The EPSS score is extremely low at 0.013%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Red Hat CVE).

Mitigation and workarounds

Wikimedia Foundation has addressed this vulnerability in AbuseFilter versions 1.43.2 and 1.44.0. Administrators running affected MediaWiki installations should upgrade the AbuseFilter extension to one of these patched versions as soon as possible. No specific configuration-based workarounds have been publicly documented (Red Hat CVE).

Additional resources

Linux Distribution fix status

Fix availability across major Linux distributions and their releases.

Debian

Fixed

bookworm

mediawiki

Fixed

sid

mediawiki: 1:1.43.3+dfsg-1

Fixed

trixie

mediawiki: 1:1.43.3+dfsg-1

Fixed

Ubuntu

Unknown

bionic (esm-apps)

mediawiki

Unknown

devel

mediawiki

Unknown

focal (esm-apps)

mediawiki

Unknown

jammy

mediawiki

Unknown

jammy (esm-apps)

mediawiki

Unknown

noble

mediawiki

Unknown

noble (esm-apps)

mediawiki

Unknown

resolute

mediawiki

Unknown

SourceThis report was generated using AI

Related Linux Debian vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2026-94106HIGH8.7
  • Linux Debian logoLinux Debian
  • php-getid3
NoNoSep 20, 2026
CVE-2026-93990HIGH8.7
  • Linux Debian logoLinux Debian
  • expat
NoNoSep 19, 2026
CVE-2026-94108HIGH8.3
  • Linux Debian logoLinux Debian
  • php-getid3
NoNoSep 20, 2026
CVE-2026-93962MEDIUM5.5
  • Linux Debian logoLinux Debian
  • kamailio
NoNoSep 20, 2026
CVE-2026-82560NONEN/A
  • Linux Debian logoLinux Debian
  • perl
NoYesSep 19, 2026

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management