CVE-2021-29483: Miraheze Managewiki

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

ManageWiki is an extension to the MediaWiki project. The 'wikiconfig' API leaked the value of private configuration variables set through the ManageWiki variable to all users. This has been patched by https://github.com/miraheze/ManageWiki/compare/99f3b2c8af18...befb83c66f5b.patch. If you are unable to patch set `$wgAPIListModules['wikiconfig'] = 'ApiQueryDisabled';` or remove private config as a workaround.

Affected products

• Miraheze Managewiki: before 2021-04-28 (fixed in 2021-04-28)

Published 2021-04-28. Last modified 2026-06-17.