MediaWiki’s users API reveals whether privileged accounts have their group memberships disabled because two‑factor authentication is missing, exposing a configuration detail that was not intended for public view. The flaw is an information‑disclosure vulnerability (CWE‑200) that allows an unauthenticated or lightly privileged actor to learn about the site’s security stance, but does not provide any code execution or service disruption capability.

The issue affects any installation of MediaWiki provided by the Wikimedia Foundation that exposes the ApiQueryAllUsers and ApiQueryUsers endpoints to the public. The vulnerable files are includes/Api/ApiQueryAllUsers.php, includes/Api/ApiQueryUsers.php, includes/Permissions/PermissionManager.php, and includes/User/User containing these files should be evaluated.

The attack vector is most likely the publicly reachable MediaWiki users API, requiring only basic network access to the site. The CVSS score of 2.1 reflects a low severity with limited impact, and the EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, further suggesting a minimal exploitation risk under current conditions.