Wikimedia Foundation’s CheckUser module contains a flaw that allows the disclosure of sensitive user data – notably suppressed usernames – to actors who are not authorized to view such information. The vulnerability stems from improper handling of suppressed data within the module’s logic, causing unintended exposure of user identities. The impact is a loss of confidentiality, potentially enabling attackers or malicious actors to identify users who have chosen to suppress their username, thereby undermining privacy protections.

The affected product is Wikimedia Foundation CheckUser, versions starting with 1.45.0 up to and including 1.45.1. Any installation running these versions without the subsequent fix is susceptible to the disclosure. All users and administrators with CheckUser privileges on impacted installations may be at risk.

The CVSS score of 4.8 categorizes the vulnerability as moderate; the EPSS score is not available, and the issue is not listed in the CISA KEV catalog. While the description does not specify the attack vector, it is inferred that an adversary with CheckUser privileges or access to the server could trigger the data leak, potentially requiring local access or exploitation of the CheckUser interface. The lack of an EPSS or KEV listing suggests a lower likelihood of widespread exploitation, yet the confidentiality breach remains significant for sensitive environments.