CVE-2025-67480: 
NixOS vulnerability analysis and mitigation

CVE-2025-67480 is an information disclosure vulnerability in Wikimedia Foundation MediaWiki, associated with the includes/Api/ApiQueryRevisionsBase.php file. It affects MediaWiki versions before 1.39.16, 1.43.6, 1.44.3, and 1.45.1. The vulnerability was published on February 3, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium), reflecting network-accessible exploitation requiring low privileges but yielding high confidentiality impact (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability is classified under CWE-551 (Incorrect Behavior Order: Authorization Before Parsing and Canonicalization) and CWE-20 (Improper Input Validation), indicating that authorization checks in the API revision query handler may occur before input is properly parsed or canonicalized, potentially allowing a low-privileged attacker to bypass access controls. The affected code resides in includes/Api/ApiQueryRevisionsBase.php, which handles API queries for page revision data. The attack vector is network-based with low attack complexity and no user interaction required, suggesting that a crafted API request could trigger the flaw (Red Hat Advisory, Red Hat Bugzilla).

Successful exploitation allows a low-privileged, remote attacker to access content with high confidentiality impact, with no effect on integrity or availability. The vulnerability may expose revision content that should be restricted — such as deleted or suppressed page revisions — to authenticated users who lack the appropriate permissions. Red Hat's internal assessment notes this as having "no direct security impact" in their product context, suggesting the practical risk may be limited to specific MediaWiki configurations (Red Hat Bugzilla, Red Hat Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-67480. The EPSS score is approximately 0.062%, indicating a very low probability of exploitation in the near term. The CVSSv4 exploit maturity is rated "UNREPORTED," and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Red Hat Advisory).

Administrators should upgrade MediaWiki to one of the following patched versions: 1.39.16, 1.43.6, 1.44.3, or 1.45.1. Debian has also issued a security advisory (DSA-6085-1) addressing this and related MediaWiki vulnerabilities, and a Debian LTS update (DLA-4428-1) is available for older supported releases. No configuration-based workarounds have been publicly documented; upgrading to a fixed version is the recommended remediation (Red Hat Advisory, Debian Security, Debian LTS).

Red Hat assessed the vulnerability as having "no direct security impact" in their product context and assigned it a low priority and severity in their bug tracker. No notable researcher commentary, social media discussion, or significant media coverage has been identified for this CVE (Red Hat Bugzilla).