A vulnerability in the Wikimedia Foundation Mediawiki – EventBus Extension allows private change tags to be exposed to anonymous users through revision‑tags‑change events. This can leak confidential information that was meant to be restricted, and because the weakness is an information disclosure flaw (CWE‑200), the attacker may learn data that could facilitate further attacks or compromise the privacy of users and contributors.

The affected product is the Wikimedia Foundation Mediawiki EventBus Extension, specifically version 1.47.0‑alpha. No other versions were listed as impacted in the current advisory.

Exploitation would require an unauthenticated actor to access the revision‑tags‑change event, which is typically delivered over HTTP. The exact CVSS score is 7.5, and the EPSS score is <1%; consequently the exploitation probability cannot be quantified from the information supplied. The advisory indicates that the vulnerability is not yet listed in the CISA KEV catalog. Until an official patch is available, the risk remains high as the flaw allows privileged data to be publicly exposed.