CVE-2021-30153

An issue was discovered in the VisualEditor extension in MediaWiki before 1.31.13, and 1.32.x through 1.35.x before 1.35.2. . When using VisualEditor to edit a MediaWiki user page belonging to an existing, but hidden, user, VisualEditor will disclose that the user exists. (It shouldn't because they are hidden.) This is related to ApiVisualEditor.

• CWE-668
• CWE-668

• https://lists.wikimedia.org/hyperkitty/list/wikitech-l%40lists.wikimedia.org/message/XYBF5RSTJRMVCP7QBYK7643W75A3KCIY/
• https://lists.wikimedia.org/pipermail/wikitech-l/2021-April/094418.htmlMailing List, Patch, Vendor Advisory
• https://phabricator.wikimedia.org/T270453Exploit, Vendor Advisory
• https://lists.wikimedia.org/hyperkitty/list/wikitech-l%40lists.wikimedia.org/message/XYBF5RSTJRMVCP7QBYK7643W75A3KCIY/
• https://lists.wikimedia.org/pipermail/wikitech-l/2021-April/094418.htmlMailing List, Patch, Vendor Advisory
• https://phabricator.wikimedia.org/T270453Exploit, Vendor Advisory

Published

Apr 15, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-30146Seafile 7.0.5 (2019) allows Persistent XSS via the "share of…5.4
• CVE-2021-30147DMA Softlab Radius Manager 4.4.0 allows CSRF with impacts su…8.8
• CVE-2021-30149Composr 10.0.36 allows upload and execution of PHP files.9.8
• CVE-2021-30150Composr 10.0.36 allows XSS in an XML script.6.1
• CVE-2021-30151Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via t…6.1
• CVE-2021-30152An issue was discovered in MediaWiki before 1.31.13 and 1.32…4.3
• CVE-2021-30154An issue was discovered in MediaWiki before 1.31.12 and 1.32…6.1
• CVE-2021-30155An issue was discovered in MediaWiki before 1.31.12 and 1.32…4.3
• CVE-2021-30156An issue was discovered in MediaWiki before 1.31.12 and 1.32…4.3
• CVE-2021-30157An issue was discovered in MediaWiki before 1.31.12 and 1.32…6.1
• CVE-2021-30158An issue was discovered in MediaWiki before 1.31.12 and 1.32…5.3
• CVE-2021-30159An issue was discovered in MediaWiki before 1.31.12 and 1.32…4.3