CVE-2026-58029 is a vulnerability in Wikimedia Foundation's MediaWiki affecting authentication-related components such as ApiChangeAuthenticationData.php, ApiLinkAccount.php, ApiRemoveAuthenticationData.php, SpecialLinkAccounts.php, and SpecialUnlinkAccounts.php. It impacts MediaWiki versions prior to 1.46.0, including 1.45.4, 1.44.6, and 1.43.9. The vulnerability is classified under CWE-287, indicating issues with improper authentication. The CVSS 4.0 base score is 5.3 (medium severity), with network attack vector, low complexity, no privileges required, and user interaction needed. The vulnerability has low confidentiality, integrity, and availability impacts. No known exploits are reported, and no official remediation or patch has been announced as of the publication date.

The vulnerability could allow an attacker to bypass or improperly manage authentication mechanisms in affected MediaWiki versions, potentially leading to unauthorized actions related to account linking or authentication data changes. The CVSS score indicates a medium impact with limited confidentiality, integrity, and availability consequences. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Wikimedia Foundation advisories for updates. Until a patch is available, consider restricting access to affected API endpoints and special pages if feasible to reduce exposure.