PageTriage’s public pagetriagelist API could reveal the identity of a suppressed user recorded as a page reviewer. The API redacted a suppressed page creator, but still returned reviewer names and user-page links.
Technical details
An anonymous request for a page with a PageTriage review record could return the suppressed reviewer’s name, user page, talk page, and contributions links. The lookup required no authentication or action from the affected user. Creating the review record and suppressing the username requires an authorized moderator.
Reproduction
On a local wiki with PageTriage enabled, create a review record, suppress the reviewer’s username, then request that page through action=pagetriagelist without logging in. The PoC makes a read-only request to a loopback API and prints the response.
Impact
Anonymous visitors could recover account identities that the wiki’s suppression process was intended to hide, using public review metadata.
References
PageTriage's public `pagetriagelist` API could reveal the identity of a suppressed user recorded as a page reviewer. The API redacted a suppressed page creator, but still returned reviewer names and user-page links.
## Technical details
An anonymous request for a page with a PageTriage review record could return the suppressed reviewer's name, user page, talk page, and contributions links. The lookup required no authentication or action from the affected user. Creating the review record and suppressing the username requires an authorized moderator.
## Reproduction
On a local wiki with PageTriage enabled, create a review record, suppress the reviewer's username, then request that page through `action=pagetriagelist` without logging in. The PoC makes a read-only request to a loopback API and prints the response.
## Impact
Anonymous visitors could recover account identities that the wiki's suppression process was intended to hide, using public review metadata.
## References
- [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-103440)
- [Public report repository](https://github.com/BomboBombone/CVE-2026-103440)
- [Phabricator report](https://phabricator.wikimedia.org/T435623)
- [PageTriage fix on Gerrit](https://gerrit.wikimedia.org/r/1346645)
- [Research index](/about/)
BomboBombone.exe