Wikimedia Foundation Echo Exposure of Sensitive Information Vulnerability

A vulnerability in the Wikimedia Foundation Echo extension allows any OAuth tool or BotPassword to access a user's notifications without the necessary permissions. This issue affects Echo versions prior to 1.43.7, 1.44.4, and 1.45.2. The notifications API can inadvertently expose private information, such as email subject lines or acknowledgments.

Impact

The vulnerability could lead to unauthorized access to user notifications, potentially exposing private information.

Remediation

A new user right grant called 'echo-read-notifications' has been created and is now available to all users. Tools that need access to user notifications must request this grant.