Technical impact
The FlaggedRevs extension fails to remove sensitive data from the user interface when review log entries are suppressed. As a result, the "Checked by" label that references a user who performed the review is still displayed in the page history. This leakage allows anyone who can view the page history to see details about suppressed review actions that should be hidden, constituting an information‑disclosure flaw. The weakness corresponds to CWE‑212.
Affected Systems
The flaw is present in all releases of the MediaWiki FlaggedRevs extension up to and including version 1.46.0, distributed by the Wikimedia Foundation. Users running older installations of the extension that process page revisions are potentially exposed. The vulnerability is tied to the FlaggedRevs code path that renders page histories.
Risk and Exploitability
The vendor scores this issue with a CVSS base score of 6.9, indicating a moderate impact. EPSS data is unavailable and the flaw is not currently listed in CISA's KEV catalog. Attackers can trigger the disclosure by simply accessing the page history of any flagged revision; no privileged access or additional conditions are required. Because the information exposed is a review identifier that has been suppressed, the risk is primarily to the privacy of contributors and the integrity of the review process.
