The vulnerability allows unauthorized actors to view sensitive information because the ApiEchoNotifications.php endpoint fails to restrict data exposure. The weakness is a plain data exposure issue (CWE‑200) and primarily compromises confidentiality without affecting integrity or availability.

The flaw is present in all Wikimedia Foundation Echo releases prior to 1.43.7, 1.44.4, or 1.45.2. Any deployment using those older releases is susceptible.

The CVSS score of 2.3 indicates a low risk rating, and the vulnerability is not listed in the CISA KEV catalog. Exploitation does not require any user credentials; an attacker only needs network access to send a request to the vulnerable ApiEchoNotifications.php endpoint and can retrieve sensitive data that should be restricted. Because EPSS is not available, the precise probability of exploitation is unknown, but the low CVSS score suggests it is not a high‑threat vulnerability.