Page MenuHomePhabricator

CVE-2026-5266: Notifications (Echo) API can be used by any OAuth tool
Closed, ResolvedPublicSecurity

Description

While I was building Tool-echo-chamber I realized that there is no specific grant/userright needed to fetch a user's notifications. This means that any BotPassword or OAuth tool can access a user's notifications. I don't think that's intended given that notifications can contain some private info like email subject lines or thanks.

I think it would benefit from getting its own userright + grant, similar to how we have viewmywatchlist.

Details

Risk Rating
High
Author Affiliation
Wikimedia Communities
Related Changes in Gerrit:
SubjectRepoBranchLines +/-
mediawiki/extensions/EchoREL1_45+13 -0
mediawiki/extensions/EchoREL1_44+13 -0
mediawiki/extensions/EchoREL1_43+13 -0
mediawiki/extensions/EchoREL1_43+11 -1
mediawiki/extensions/EchoREL1_45+11 -1
mediawiki/extensions/EchoREL1_44+11 -1
mediawiki/extensions/EchoREL1_43+18 -14
mediawiki/extensions/EchoREL1_44+18 -14
mediawiki/extensions/EchoREL1_45+18 -14
mediawiki/extensions/EchoREL1_44+56 -27
mediawiki/extensions/EchoREL1_43+56 -27
mediawiki/extensions/EchoREL1_45+56 -27
mediawiki/extensions/EchoREL1_44+1 -1
mediawiki/extensions/EchoREL1_45+1 -1
mediawiki/extensions/EchoREL1_43+1 -1
mediawiki/extensions/Echowmf/1.46.0-wmf.22+18 -14
mediawiki/extensions/Echomaster+11 -1
mediawiki/extensions/Echowmf/1.46.0-wmf.22+13 -0
mediawiki/extensions/Echowmf/1.46.0-wmf.22+56 -27
mediawiki/extensions/Echowmf/1.46.0-wmf.22+1 -1
mediawiki/extensions/Echowmf/1.46.0-wmf.22+15 -3
mediawiki/extensions/Echomaster+18 -14
mediawiki/extensions/Echomaster+13 -0
mediawiki/extensions/Echomaster+56 -27
mediawiki/extensions/Echomaster+1 -1
mediawiki/extensions/EchoREL1_44+15 -3
mediawiki/extensions/EchoREL1_43+15 -3
mediawiki/extensions/EchoREL1_45+15 -3
mediawiki/extensions/Echomaster+15 -3
Show related patches Customize query in gerrit

Event Timeline

There are a very large number of changes, so older changes are hidden. Show Older Changes

Change #1265622 merged by jenkins-bot:

[mediawiki/extensions/Echo@REL1_43] SECURITY: Protect ApiEchoNotifications with a new user right

https://gerrit.wikimedia.org/r/1265622

Change #1265621 merged by jenkins-bot:

[mediawiki/extensions/Echo@REL1_44] SECURITY: Protect ApiEchoNotifications with a new user right

https://gerrit.wikimedia.org/r/1265621

Change #1266286 had a related patch set uploaded (by Urbanecm; author: Urbanecm):

[mediawiki/extensions/Echo@master] Create a new grant for the echo-read-notifications

https://gerrit.wikimedia.org/r/1266286

Change #1266289 had a related patch set uploaded (by Urbanecm; author: Urbanecm):

[mediawiki/extensions/Echo@master] [i18n] Correct the action message

https://gerrit.wikimedia.org/r/1266289

Change #1266289 merged by jenkins-bot:

[mediawiki/extensions/Echo@master] [i18n] Correct the action message

https://gerrit.wikimedia.org/r/1266289

Change #1266296 had a related patch set uploaded (by Urbanecm; author: Urbanecm):

[mediawiki/extensions/Echo@master] refactor: Use a trait to check for reading permissions

https://gerrit.wikimedia.org/r/1266296

Change #1266300 had a related patch set uploaded (by Urbanecm; author: Urbanecm):

[mediawiki/extensions/Echo@master] feat: Respect the echo-read-notifications right in SpecialNotifications

https://gerrit.wikimedia.org/r/1266300

Change #1266296 merged by jenkins-bot:

[mediawiki/extensions/Echo@master] refactor: Use a trait to check for reading permissions

https://gerrit.wikimedia.org/r/1266296

@Trizek-WMF - Can you take a look at this and decide if this needs to be added to tech news?

@Trizek-WMF - Can you take a look at this and decide if this needs to be added to tech news?

Impact: Tools like Tool-echo-chamber are currently unable to read notifications (they'll need to request access to the "View my notifications" grant, which will be available once the pending patches merge).

All should be in code review and mergeable now.

@Trizek-WMF - Can you take a look at this and decide if this needs to be added to tech news?

Impact: Tools like Tool-echo-chamber are currently unable to read notifications (they'll need to request access to the "View my notifications" grant, which will be available once the pending patches merge).

What is the visible consequence for users, before and after the merge?

I don't think it needs a tech news announcement personally, mediawiki-api-announce would be more appropriate.

If it only impacts tech audiences, in particular specialized ones, then yes, mediawiki-api-announce is a better option.

What is the visible consequence for users, before and after the merge?

Community-developped tools that need access to user notification are not working at the moment (the maintainer needs to request access to notifications to be able to retrieve them). Happy to write a mediawiki-api-announce message if it sounds like a better idea.

Change #1266286 merged by jenkins-bot:

[mediawiki/extensions/Echo@master] Create a new grant for the echo-read-notifications

https://gerrit.wikimedia.org/r/1266286

Change #1266300 merged by jenkins-bot:

[mediawiki/extensions/Echo@master] Respect the echo-read-notifications right in user interface

https://gerrit.wikimedia.org/r/1266300

Change #1268099 had a related patch set uploaded (by Novem Linguae; author: Novem Linguae):

[mediawiki/extensions/Echo@master] ApiEchoPermissionsTrait: don't show $1 to user

https://gerrit.wikimedia.org/r/1268099

Change #1268196 had a related patch set uploaded (by Urbanecm; author: Urbanecm):

[mediawiki/extensions/Echo@wmf/1.46.0-wmf.22] SECURITY: Protect ApiEchoNotifications with a new user right

https://gerrit.wikimedia.org/r/1268196

Change #1268197 had a related patch set uploaded (by Urbanecm; author: Urbanecm):

[mediawiki/extensions/Echo@wmf/1.46.0-wmf.22] [i18n] Correct the action message

https://gerrit.wikimedia.org/r/1268197

Change #1268198 had a related patch set uploaded (by Urbanecm; author: Urbanecm):

[mediawiki/extensions/Echo@wmf/1.46.0-wmf.22] refactor: Use a trait to check for reading permissions

https://gerrit.wikimedia.org/r/1268198

Change #1268199 had a related patch set uploaded (by Urbanecm; author: Urbanecm):

[mediawiki/extensions/Echo@wmf/1.46.0-wmf.22] Create a new grant for the echo-read-notifications

https://gerrit.wikimedia.org/r/1268199

Change #1268196 merged by jenkins-bot:

[mediawiki/extensions/Echo@wmf/1.46.0-wmf.22] SECURITY: Protect ApiEchoNotifications with a new user right

https://gerrit.wikimedia.org/r/1268196

Change #1268197 merged by jenkins-bot:

[mediawiki/extensions/Echo@wmf/1.46.0-wmf.22] [i18n] Correct the action message

https://gerrit.wikimedia.org/r/1268197

Change #1268198 merged by jenkins-bot:

[mediawiki/extensions/Echo@wmf/1.46.0-wmf.22] refactor: Use a trait to check for reading permissions

https://gerrit.wikimedia.org/r/1268198

Change #1268199 merged by jenkins-bot:

[mediawiki/extensions/Echo@wmf/1.46.0-wmf.22] Create a new grant for the echo-read-notifications

https://gerrit.wikimedia.org/r/1268199

Change #1268201 had a related patch set uploaded (by Urbanecm; author: Urbanecm):

[mediawiki/extensions/Echo@wmf/1.46.0-wmf.22] Respect the echo-read-notifications right in user interface

https://gerrit.wikimedia.org/r/1268201

I think this can be made public now? @Reedy @sbassett

No objections from my end.

sbassett changed Author Affiliation from N/A to Wikimedia Communities.
sbassett removed a project: Patch-For-Review.
sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".
sbassett changed the edit policy from "Custom Policy" to "All Users".
sbassett changed Risk Rating from N/A to High.
sbassett moved this task from Watching to Our Part Is Done on the Security-Team board.

Change #1268099 merged by jenkins-bot:

[mediawiki/extensions/Echo@master] ApiEchoPermissionsTrait: don't show $1 to user

https://gerrit.wikimedia.org/r/1268099

Change #1268201 merged by jenkins-bot:

[mediawiki/extensions/Echo@wmf/1.46.0-wmf.22] Respect the echo-read-notifications right in user interface

https://gerrit.wikimedia.org/r/1268201

Mentioned in SAL (#wikimedia-operations) [2026-04-06T20:44:10Z] <urbanecm@deploy1003> Started scap sync-world: Backport for [[gerrit:1268201|Respect the echo-read-notifications right in user interface (T420154)]], [[gerrit:1268202|Grant new 'echo-read-notifications' right to all users (T422297)]]

Mentioned in SAL (#wikimedia-operations) [2026-04-06T20:45:44Z] <urbanecm@deploy1003> urbanecm: Backport for [[gerrit:1268201|Respect the echo-read-notifications right in user interface (T420154)]], [[gerrit:1268202|Grant new 'echo-read-notifications' right to all users (T422297)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2026-04-06T20:50:40Z] <urbanecm@deploy1003> Finished scap sync-world: Backport for [[gerrit:1268201|Respect the echo-read-notifications right in user interface (T420154)]], [[gerrit:1268202|Grant new 'echo-read-notifications' right to all users (T422297)]] (duration: 06m 30s)

Mentioned in SAL (#wikimedia-cloud) [2026-04-06T23:22:50Z] <wmbot~lucaswerkmeister@tools-bastion-15> deployed d83be52ab9 (reenable notifications feature with new OAuth consumer: T420154, T421991)

What is the visible consequence for users, before and after the merge?

Given that multiple bots and tools broke, the blast radius was certainly bigger than I personally expected. I've added a note to the next tech news: https://meta.wikimedia.org/w/index.php?title=Tech/News/2026/16&diff=prev&oldid=30369555

Someone still needs to send an email to mediawiki-api-announce...

Change #1269517 had a related patch set uploaded (by Reedy; author: Urbanecm):

[mediawiki/extensions/Echo@REL1_45] [i18n] Correct the action message

https://gerrit.wikimedia.org/r/1269517

Change #1269518 had a related patch set uploaded (by Reedy; author: Urbanecm):

[mediawiki/extensions/Echo@REL1_44] [i18n] Correct the action message

https://gerrit.wikimedia.org/r/1269518

Change #1269519 had a related patch set uploaded (by Reedy; author: Urbanecm):

[mediawiki/extensions/Echo@REL1_43] [i18n] Correct the action message

https://gerrit.wikimedia.org/r/1269519

Change #1269519 merged by jenkins-bot:

[mediawiki/extensions/Echo@REL1_43] [i18n] Correct the action message

https://gerrit.wikimedia.org/r/1269519

Change #1269517 merged by jenkins-bot:

[mediawiki/extensions/Echo@REL1_45] [i18n] Correct the action message

https://gerrit.wikimedia.org/r/1269517

Change #1269518 merged by jenkins-bot:

[mediawiki/extensions/Echo@REL1_44] [i18n] Correct the action message

https://gerrit.wikimedia.org/r/1269518

Change #1269521 had a related patch set uploaded (by Reedy; author: Urbanecm):

[mediawiki/extensions/Echo@REL1_45] refactor: Use a trait to check for reading permissions

https://gerrit.wikimedia.org/r/1269521

Change #1269522 had a related patch set uploaded (by Reedy; author: Urbanecm):

[mediawiki/extensions/Echo@REL1_44] refactor: Use a trait to check for reading permissions

https://gerrit.wikimedia.org/r/1269522

Change #1269523 had a related patch set uploaded (by Reedy; author: Urbanecm):

[mediawiki/extensions/Echo@REL1_43] refactor: Use a trait to check for reading permissions

https://gerrit.wikimedia.org/r/1269523

Change #1269521 merged by jenkins-bot:

[mediawiki/extensions/Echo@REL1_45] refactor: Use a trait to check for reading permissions

https://gerrit.wikimedia.org/r/1269521

Change #1269523 merged by jenkins-bot:

[mediawiki/extensions/Echo@REL1_43] refactor: Use a trait to check for reading permissions

https://gerrit.wikimedia.org/r/1269523

Change #1269522 merged by jenkins-bot:

[mediawiki/extensions/Echo@REL1_44] refactor: Use a trait to check for reading permissions

https://gerrit.wikimedia.org/r/1269522

Change #1269528 had a related patch set uploaded (by Reedy; author: Urbanecm):

[mediawiki/extensions/Echo@REL1_45] Respect the echo-read-notifications right in user interface

https://gerrit.wikimedia.org/r/1269528

Change #1269529 had a related patch set uploaded (by Reedy; author: Urbanecm):

[mediawiki/extensions/Echo@REL1_44] Respect the echo-read-notifications right in user interface

https://gerrit.wikimedia.org/r/1269529

Change #1269530 had a related patch set uploaded (by Reedy; author: Urbanecm):

[mediawiki/extensions/Echo@REL1_43] Respect the echo-read-notifications right in user interface

https://gerrit.wikimedia.org/r/1269530

Change #1269528 merged by jenkins-bot:

[mediawiki/extensions/Echo@REL1_45] Respect the echo-read-notifications right in user interface

https://gerrit.wikimedia.org/r/1269528

Change #1269529 merged by jenkins-bot:

[mediawiki/extensions/Echo@REL1_44] Respect the echo-read-notifications right in user interface

https://gerrit.wikimedia.org/r/1269529

Change #1269530 merged by jenkins-bot:

[mediawiki/extensions/Echo@REL1_43] Respect the echo-read-notifications right in user interface

https://gerrit.wikimedia.org/r/1269530

Change #1269553 had a related patch set uploaded (by Reedy; author: Novem Linguae):

[mediawiki/extensions/Echo@REL1_45] ApiEchoPermissionsTrait: don't show $1 to user

https://gerrit.wikimedia.org/r/1269553

Change #1269554 had a related patch set uploaded (by Reedy; author: Novem Linguae):

[mediawiki/extensions/Echo@REL1_44] ApiEchoPermissionsTrait: don't show $1 to user

https://gerrit.wikimedia.org/r/1269554

Change #1269555 had a related patch set uploaded (by Reedy; author: Novem Linguae):

[mediawiki/extensions/Echo@REL1_43] ApiEchoPermissionsTrait: don't show $1 to user

https://gerrit.wikimedia.org/r/1269555

Change #1269554 merged by jenkins-bot:

[mediawiki/extensions/Echo@REL1_44] ApiEchoPermissionsTrait: don't show $1 to user

https://gerrit.wikimedia.org/r/1269554

Change #1269553 merged by jenkins-bot:

[mediawiki/extensions/Echo@REL1_45] ApiEchoPermissionsTrait: don't show $1 to user

https://gerrit.wikimedia.org/r/1269553

Change #1269555 merged by jenkins-bot:

[mediawiki/extensions/Echo@REL1_43] ApiEchoPermissionsTrait: don't show $1 to user

https://gerrit.wikimedia.org/r/1269555

Change #1269569 had a related patch set uploaded (by Reedy; author: Urbanecm):

[mediawiki/extensions/Echo@REL1_44] Create a new grant for the echo-read-notifications

https://gerrit.wikimedia.org/r/1269569

Change #1269570 had a related patch set uploaded (by Reedy; author: Urbanecm):

[mediawiki/extensions/Echo@REL1_45] Create a new grant for the echo-read-notifications

https://gerrit.wikimedia.org/r/1269570

Change #1269571 had a related patch set uploaded (by Reedy; author: Urbanecm):

[mediawiki/extensions/Echo@REL1_43] Create a new grant for the echo-read-notifications

https://gerrit.wikimedia.org/r/1269571

Change #1269571 merged by jenkins-bot:

[mediawiki/extensions/Echo@REL1_43] Create a new grant for the echo-read-notifications

https://gerrit.wikimedia.org/r/1269571

Change #1269569 merged by jenkins-bot:

[mediawiki/extensions/Echo@REL1_44] Create a new grant for the echo-read-notifications

https://gerrit.wikimedia.org/r/1269569

Change #1269570 merged by jenkins-bot:

[mediawiki/extensions/Echo@REL1_45] Create a new grant for the echo-read-notifications

https://gerrit.wikimedia.org/r/1269570