An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. HTMLUserTextField exposes the existence of hidden users.
{
"versions": [
{
"introduced": "0"
},
{
"fixed": "1.35.8"
},
{
"introduced": "1.36.0"
},
{
"fixed": "1.37.5"
},
{
"introduced": "1.38.0"
},
{
"fixed": "1.38.3"
}
]
}