The flaw allows an unauthenticated requester to retrieve the identities and permission levels of all users in a private MediaWiki instance. This information disclosure aligns with CWE‑200 and could be leveraged for targeted social‑engineering attacks or insider‑threat investigations. With a CVSS core of 5.1, the impact is considered moderate and primarily affects confidentiality.

The vulnerability exists in every MediaWiki release earlier than 1.46.0 from the Wikimedia Foundation—including the specific patched releases 1.45.4, 1.44.6, and 1.43.9—that lacks the fix. Private wikis whose API endpoint is reachable by external actors are affected. The faulty code resides in includes/Api/ApiUserrights.php and is triggered by the 'userrights' API action.

Attackers can simply issue an unauthenticated HTTP GET request to /api.php with the userrights parameter; no credentials are required. The EPSS score of <1% suggests a low exploitation probability, and the flaw is not listed in the CISA KEV catalog. Nevertheless, disclosure of user roles in a private environment creates a confidentiality risk that can aid in phishing or collaborative attacks, so timely remediation is advised.