This vulnerability (CVE-2026-58027) in Wikimedia Foundation's AbuseFilter involves exposure of sensitive information to unauthorized actors, classified under CWE-200. It affects AbuseFilter versions prior to 1.46.0, including exact versions 1.45.4, 1.44.6, and 1.43.9. The vulnerability is associated with the file includes/Api/QueryAbuseFilters.Php. The CVSS 4.0 base score is 5.3, indicating medium severity, with network attack vector, low complexity, no privileges required, and no user interaction needed. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

The vulnerability allows unauthorized actors to gain access to sensitive information from the AbuseFilter component, potentially compromising confidentiality. The medium CVSS score reflects a moderate risk due to ease of network exploitation without privileges or user interaction. No direct evidence of active exploitation is reported.

Patch status is not yet confirmed — check the Wikimedia Foundation vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected AbuseFilter versions and monitor for unusual access patterns related to the QueryAbuseFilters API. Avoid exposing the vulnerable component to untrusted networks if possible.