The vulnerability resides in the CentralAuth Extension of MediaWiki, allowing an attacker to retrieve block information that is normally suppressed locally through the globaluserinfo API and Special:CentralAuth. This exposure reveals sensitive user and block data to unauthorized actors, which can lead to privacy violations or facilitate further attacks. The weakness is classified under CWE‑200 (Information Exposure).

It affects the Wikimedia Foundation MediaWiki CentralAuth Extension. All releases prior to 1.46.1, with 1.45.5, and 1.43.10 are vulnerable. Any MediaWiki instance using those versions or earlier is at risk.

The vulnerability is an information disclosure. The CVE description itself does not mention any publicly available exploit code, so it is unclear whether exploit code exists. The EPSS score for this issue is not available. The CVSS score is not provided, so the severity cannot be precisely measured; however, the potential impact on the confidentiality of block information is high. Attackers can use existing API endpoints; the description indicates that the globaluserinfo API and Special:CentralAuth endpoints may be abused to retrieve suppressed block information. The exact attack vector is not explicitly stated in the CVE description but is inferred from the exposed endpoints. No additional special conditions beyond access to the API endpoint are mentioned. Because the vulnerability permits retrieval of data that is normally hidden, the risk is primarily privacy-oriented rather than leading to system compromise.