CVE-2025-23074 Special:EditProfile exposes the contents of profile fields marked "hidden"/friends or "friends of friends" when the privileged user isn't a friend of the user whose profile they edit(ed)

[
  {
    "defaultStatus": "unaffected",
    "product": "Mediawiki - SocialProfile Extension",
    "vendor": "Wikimedia Foundation",
    "versions": [
      {
        "lessThan": "1.39.11",
        "status": "affected",
        "version": "1.39.x",
        "versionType": "semver"
      },
      {
        "lessThan": "1.41.3",
        "status": "affected",
        "version": "1.41.x",
        "versionType": "semver"
      },
      {
        "lessThan": "1.42.2",
        "status": "affected",
        "version": "1.42.x",
        "versionType": "semver"
      }
    ]
  }
]