MediaWiki before 1.23.15 1.26.x before 1.26.4 and 1.27.x before 1.27.1 when $wgBlockDisablesLogin is true might allow remote attackers to obtain sensitive information by leveraging failure to terminate sessions when a user account is blocked.