The flaw lies in MediaWiki’s failure to exclude revisions where the author field has been deleted. As a result, the action=info endpoint can return records that expose identities associated with deletions, letting an unauthenticated user learn details of users that had been removed. The vulnerability is categorized as CWE‑200.

MediaWiki installations from the Wikimedia Foundation released before 1.46.0—specifically the 1.45.4, 1.44.6, and 1.43.9 point releases—are vulnerable if they expose the action=info endpoint. Any site running these configurations can be affected when unauthenticated access to the endpoint is allowed.

The CVSS score of 5.3 coupled with an EPSS score of < 1% indicates a low but nonzero probability of exploitation. The vulnerability is not listed in CISA KEV. An attacker does not need authentication; they can simply request the action=info page from any network location that can reach the MediaWiki instance. Successful exploitation would reveal private author data that should have been protected, potentially enabling social engineering or privacy violations.