The flaw stems from a missing authorization check in the MediaWiki TemplateSandbox Extension, allowing users to preview pages they are not permitted to read. Based on the description, the likely attack vector is the web-based preview endpoint, where an attacker can construct a request that bypasses read permissions. By generating such a preview, the attacker can view the content of restricted pages without proper ACL enforcement. This exposes private or confidential information and can be leveraged to further attacks, such as phishing or social engineering when sensitive data is revealed.

The vulnerability affects the Wikimedia Foundation MediaWiki - TemplateSandbox Extension versions prior to 1.46.1, 1.45.5, and 1.43.10. Deployments of those releases on any MediaWiki installation are at risk until a newer patch is applied.

The EPSS score of < 1% and the vulnerability is not listed in CISA's KEV catalog, suggesting no publicly available exploits yet, but the potential impact is high due to the exposure of protected content. Based on the description, the likely attack vector is remote access via the web interface's preview endpoint. Attackers could exploit the lack of read-permission checks by requesting the preview endpoint, thereby obtaining information. Because the flaw involves improper access control (CWE-862), the risk is primarily exploitation of sensitive data rather than denial of service or code execution.