The CampaignEvents extension for MediaWiki contains a missing authorization check. This flaw, classified as CWE-862, allows unprivileged users to call API endpoints that return meeting and chat URLs. The exposed URLs can grant access to private resources, enabling unauthorized viewing or participation in meetings and chats.

Affected systems include the Wikimedia Foundation's MediaWiki CampaignEvents extension in versions 1.45, 1.44, 1.43, and 1.39. Users running these versions are vulnerable until the issue is addressed.

The CVSS base score of 5.3 indicates moderate severity, while an EPSS score of less than 1 % suggests a low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that attackers could exploit the flaw remotely by sending crafted API requests to exposed endpoints, assuming no prior authorization constraints. Given the low exploitation likelihood, administrators should prioritize applying an official fix and tightening access controls.