The vulnerability allows an authenticated user to invoke the action=changeauthenticationdata API endpoint on another user’s account in MediaWiki. This endpoint replaces the target account’s authentication data without performing the required authorization check, effectively giving the attacker full control over that account. The weakness is an authentication bypass consistent with CWE‑287, and the potential impact is direct impersonation of any user who can be targeted, granting the attacker every privilege the victim normally held. The attack vector is not explicitly documented but is inferred from an authenticated request to the vulnerable endpoint.

The issue affects Wikimedia Foundation MediaWiki versions prior to 1.46.0, 1.45.4, 1.44.6, and 1.43.9. Any instance running a version older than these thresholds is vulnerable.

The CVSS score of 5.3 classifies the vulnerability as moderate severity, while the EPSS score of less than 1 % indicates a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, so no widely known exploits exist yet. Exploitation requires the attacker to be authenticated to the MediaWiki instance, either through legitimate credentials or through compromised BotPasswords or OAuth tokens, and then to send a request to the vulnerable API endpoint. The likely attack vector is inferred to involve an attacker who has already authenticated, for example via compromised BotPasswords or OAuth tokens; precise details are not disclosed. Based on the description, the vulnerability appears to lack arbitrary code‑execution capabilities, limiting the attack to the API layer, but the effect remains a total takeover of the target account.