CVE-2025-6927: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-6927 is an information disclosure vulnerability in Wikimedia Foundation MediaWiki affecting the BlockListPager and ApiQueryBlocks components (includes/specials/pagers/BlockListPager.php and includes/api/ApiQueryBlocks.php). It allows unauthenticated network attackers to access sensitive block list data due to incompatible access control policies. The vulnerability affects MediaWiki versions from 1.42.0 up to (but not including) the patched releases 1.39.13, 1.42.7, 1.43.2, and 1.44.0. It carries a CVSS v4.0 base score of 2.3 (Low) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-213 (Exposure of Sensitive Information Due to Incompatible Policies), with a secondary classification of CWE-22 (Path Traversal), though the primary exploitation vector is information disclosure rather than file system traversal. The vulnerability exists in the block list handling logic within BlockListPager.php and ApiQueryBlocks.php, where access control policies governing the visibility of block list data are inconsistently enforced, allowing unauthorized parties to retrieve information that should be restricted. Exploitation requires passive user interaction and the presence of specific attack conditions (attack requirements: present), limiting its practical exploitability (Red Hat Advisory, Red Hat Bugzilla).

Successful exploitation results in low-level confidentiality impact, exposing sensitive block list data (such as information about blocked users or IPs) to unauthenticated attackers over the network. There is no impact to system integrity or availability. The scope is limited to the MediaWiki application layer, with no evidence of lateral movement potential or broader system compromise (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires passive user interaction and specific preconditions, further reducing practical exploitability (Red Hat Advisory).

Users should upgrade MediaWiki to one of the patched versions: 1.39.13, 1.42.7, 1.43.2, or 1.44.0 (or later). No specific configuration-based workarounds have been publicly documented. Organizations running MediaWiki 1.42.0 or later should prioritize patching and monitor access logs for unusual queries to block list endpoints (Red Hat Advisory, Red Hat Bugzilla).