Technical impact
The vulnerability arises from MediaWiki’s AbuseFilter and EventStream components that unintentionally expose user locale data to anyone able to read the event streams. The leakage allows an unauthorised actor to determine the geographical or language preferences of a user, revealing sensitive private information. This can be leveraged to deanonymise users or gain insight into user behaviour, violating the confidentiality of user data. The flaw is a typical information‑disclosure weakness.
Affected Systems
The issue affects all releases of MediaWiki before 1.43.7, 1.44.4, and 1.45.2, including any older versions still in use. The vulnerable component is part of the core Wikimedia Foundation MediaWiki distribution.
Risk and Exploitability
The CVSS score of 5.5 indicates moderate severity. EPSS score of 0.00042 indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. However, the bug can be triggered by any user with access to the event stream or AbuseFilter logs, meaning the attack vector is likely local or network‑based wherever event streams are exposed. Given that the flaw does not require privileged access, moderate risk remains until a fix is applied.
Debian DSA