The vulnerability arises from MediaWiki’s AbuseFilter and EventStream components that unintentionally expose user locale data to anyone able to read the event streams. The leakage allows an unauthorised actor to determine the geographical or language preferences of a user, revealing sensitive private information. This can be leveraged to deanonymise users or gain insight into user behaviour, violating the confidentiality of user data. The flaw is a typical information‑disclosure weakness (CWE‑200).

The issue affects all releases of MediaWiki before 1.43.7, 1.44.4, and 1.45.2, including any older versions still in use. The vulnerable component is part of the core Wikimedia Foundation MediaWiki distribution.

The CVSS score of 5.5 indicates moderate severity. EPSS is not available, so the likelihood of exploitation is unclear. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. However, the bug can be triggered by any user with access to the event stream or AbuseFilter logs, meaning the attack vector is likely local or network-based wherever event streams are exposed. Given that the flaw does not require privileged access, moderate risk remains until a fix is applied.