This vulnerability (CVE-2026-34091) in MediaWiki involves the exposure of sensitive information to unauthorized actors, classified under CWE-200. It affects all versions prior to 1.43.7, 1.44.4, and 1.45.2. The CVSS 4.0 base score is 5.5 (medium severity), with an attack vector of network, no privileges or user interaction required, and low complexity. The vulnerability does not involve integrity or availability impacts, only confidentiality. No vendor advisory or patch links are currently available, and the remediation level is unspecified.

The impact is limited to unauthorized disclosure of sensitive information without requiring authentication or user interaction. There is no impact on system integrity or availability. This could potentially allow attackers to gain access to information that should be protected, but the overall severity is medium based on the CVSS score.

Patch status is not yet confirmed — check the Wikimedia Foundation vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor for updates from the vendor. No specific mitigation steps are currently documented.