This vulnerability (CWE-200) in MediaWiki involves the exposure of sensitive information to unauthorized actors due to a flaw in the InfoAction.Php program file. It affects all versions before 1.43.9, 1.44.6, 1.45.4, and 1.46.0. The CVSS 4.0 base score is 5.3, indicating a medium severity with network attack vector, low complexity, no privileges required, and user interaction needed. No vendor advisory or patch information is available at this time.

An attacker can gain access to sensitive information that should not be disclosed, potentially leading to information leakage. The vulnerability does not require privileges or authentication but does require user interaction. The impact is limited to information exposure without direct integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider limiting access to affected MediaWiki instances and monitoring for suspicious activity related to information disclosure.