The vulnerability arises because the link generated for the page protection indicator in MediaWiki omits the required "/wiki/" prefix, causing the link to become relative to the current subpage. This fault leads to broken or misleading help links for users viewing protected pages. While the flaw does not directly expose confidential data or allow arbitrary code execution, it could confuse users or inadvertently direct them to unintended content. The weakness can be mapped to CWE‑668: Improper Access Control.

Affected systems are all MediaWiki installations prior to the release of versions 1.43.7, 1.44.4, and 1.45.2. The vulnerability is documented as stemming from includes/Page/Article.php. Any instance of MediaWiki before those dates that has not yet applied official patches remains susceptible.

The CVSS score is 2, indicating a low severity assessment. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, suggesting that exploitation is unlikely. The likely attack vector involves a user creating or linking to a subpage that would trigger the faulty link generation; the impact is primarily user experience degradation rather than a critical security compromise. Nevertheless, administrators are advised to address the flaw to maintain correct site functionality.