This vulnerability (CVE-2026-58024) in MediaWiki involves exposure of sensitive information to unauthorized actors, classified under CWE-200. It is associated with the program file includes/Api/ApiUserrights.php and affects all versions before 1.43.9, 1.44.6, 1.45.4, and 1.46.0. The CVSS 4.0 base score is 5.1, indicating medium severity, with network attack vector, low complexity, and requiring low privileges and user interaction. No vendor advisory or patch information is currently available, and the vulnerability is not known to be exploited in the wild.

The vulnerability allows unauthorized actors to gain access to sensitive information within MediaWiki installations running affected versions. This could lead to information disclosure that may assist further attacks or compromise privacy. However, the impact is limited to information exposure without integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is provided, administrators should monitor the Wikimedia Foundation advisories for updates and consider restricting access to the affected API endpoint as a precautionary measure.