The vulnerability identified as CVE-2026-103047 is a stored cross-site scripting (XSS) flaw in the CentralAuth extension of Mediawiki. It arises from improper input neutralization during web page generation, allowing malicious scripts to be stored and executed in users' browsers. The affected versions are those prior to 1.46.1, 1.45.5, and 1.43.10 of the CentralAuth extension. There is no CVSS score or detailed vendor advisory provided, and no known active exploitation has been reported.

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts that execute in the context of users' browsers when they view affected pages. This can lead to session hijacking, defacement, or other malicious actions within the scope of the user's permissions. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade the CentralAuth extension to versions 1.46.1, 1.45.5, or 1.43.10 or later once official patches are available. Until then, monitor vendor communications for updates and apply recommended fixes promptly.