The vulnerability in MediaWiki exposes the user access rights of a private wiki to anyone who can view the Special:UserRights page. The information disclosed is the set of permissions granted to each account, which may reveal administrative privileges or other sensitive roles. The weakness is classified as a confidentiality breach and mapped to CWE‑200.

MediaWiki installations running a version earlier than 1.43.7, 1.44.4, or 1.45.2 are affected. The vulnerable code resides in the SpecialUserRights.php file located in the Specials directory and exports the user rights data without proper authorization checks.

The CVSS score of 1.1 indicates that, in a default configuration, the overall risk is very low. No EPSS score is available, and the vulnerability is not listed in CISA KEV. The likely attack vector is accessing the Special:UserRights page, as described in the advisory. Based on the description, it is inferred that an attacker would need to reach that page, which is normally restricted to privileged users, so the practicality of exploitation is limited under standard settings.