The vulnerability identified as CVE-2026-39937 (CWE-212) concerns improper removal of sensitive information in the Mediawiki CentralAuth Extension maintained by the Wikimedia Foundation. This issue results in resource leak exposure, potentially allowing sensitive data to be retained unintentionally during storage or transfer processes. The vulnerability affects non-release branches, indicating it may be present in development or pre-release versions rather than stable releases. The CVSS 4.0 score is 8.8, reflecting a high severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality. No patch or remediation guidance has been published by the vendor yet.

The vulnerability can lead to exposure of sensitive information due to improper cleanup before storage or transfer, which may compromise confidentiality. Since it affects non-release branches, the impact on production environments may be limited unless those branches are deployed. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the Wikimedia Foundation advisory for current remediation guidance. Since the issue affects non-release branches, avoid using development or pre-release versions of the CentralAuth Extension in production environments until a fix is available.