CVE-2025-61652

N/A Unknown

📋 TL;DR

This vulnerability in Wikimedia Foundation DiscussionTools allows attackers to execute unauthorized actions or access restricted functionality. It affects all Wikimedia sites using DiscussionTools before patched versions. Users of affected versions are vulnerable to exploitation.

💻 Affected Systems

Products:
  • Wikimedia Foundation DiscussionTools
Versions: All versions before 1.43.4 and 1.44.1
Operating Systems: All
Default Config Vulnerable: ⚠️ Yes
Notes: Affects all Wikimedia installations using DiscussionTools extension

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of discussion functionality, potential data manipulation or unauthorized content modification

🟠

Likely Case

Limited privilege escalation or unauthorized access to discussion features

🟢

If Mitigated

Minimal impact with proper access controls and monitoring

🌐 Internet-Facing: HIGH
🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: MEDIUM

Exploitation likely requires some level of access or interaction with discussion features

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.43.4 or 1.44.1

Vendor Advisory: https://phabricator.wikimedia.org/T397580

Restart Required: Yes

Instructions:

1. Update DiscussionTools extension to version 1.43.4 or 1.44.1
2. Clear MediaWiki cache
3. Restart web server services

🔧 Temporary Workarounds

Disable DiscussionTools

all

Temporarily disable the vulnerable extension

$wgEnableDiscussionTools = false;

🧯 If You Can't Patch

  • Implement strict access controls and monitoring on discussion features
  • Disable or restrict DiscussionTools functionality to trusted users only

🔍 How to Verify

Check if Vulnerable:

Check DiscussionTools version in MediaWiki configuration or extension manager

Check Version:

Check LocalSettings.php or extension configuration for $wgDiscussionToolsVersion

Verify Fix Applied:

Confirm DiscussionTools version is 1.43.4 or higher, or 1.44.1 or higher

📡 Detection & Monitoring

Log Indicators:

  • Unusual discussion activity patterns
  • Unauthorized discussion tool API calls

Network Indicators:

  • Abnormal requests to discussion-related endpoints

SIEM Query:

source="mediawiki" AND (event="discussion_tools" OR uri="/api/discussion") AND status="403" OR status="200" with unusual patterns

📊 Metadata

CVE ID: CVE-2025-61652
CVSS v3 Score: N/A (Unknown)
Published: February 3, 2026
Last Updated: February 4, 2026

🤖 AI-assisted analysis, reviewed for accuracy

🔗 References

📤 Share This