The vulnerability allows an unauthorized actor to determine whether privileged users have their user groups disabled because they lack two‑factor authentication through the Wikimedia Foundation OATHAuth Users API. This disclosure of privileged account status is a confidentiality breach (CWE‑200) and can enable attackers to target privileged users or craft tailored social engineering attacks.

Wikimedia Foundation OATHAuth deployments prior to version 1.43.7, 1.44.4, and 1.45.2 are affected. The issue exists in all earlier releases of the software.

The CVSS score of 5.1 denotes moderate risk, and the EPSS score is not available, leaving exploit probability uncertain. The vulnerability is not listed in the CISA KEV catalog, implying it may not be widely exploited currently. Nevertheless, because it reveals privileged user status, an attacker who can reach the API can focus subsequent attacks on identified accounts. The most likely attack vector is through the public or unauthenticated API endpoint that returns privileged user data.