CVE-2010-2787: api.php in MediaWiki before 1.15.5 does not prevent use of public caching headers for private data, which a...

Security readout for executives and security teams

Older MediaWiki could let private API responses be stored as public cache entries. If a victim accessed private data through a shared HTTP proxy cache, another remote user could potentially retrieve that cached data and bypass intended access controls. Exposure is most likely on MediaWiki versions before 1.15.5, especially where shared proxies, reverse proxies, or caching layers handled authenticated or restricted api.php responses. Prioritize remediation if the organization still runs legacy MediaWiki or shared web caching in front of it. The issue is old, but it affects confidentiality and can expose restricted wiki data without direct account compromise. Mitigation focus: Upgrade affected MediaWiki installations to 1.15.5, 1.16.0, or later vendor-supported releases.; Review Wikimedia and distribution advisories for exact package versions and backported fixes.; Purge shared proxy, reverse proxy, and CDN caches that may contain private API responses..

Prepared

Jun 24, 2026, 13:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.