Robyn Bergeron announced the issue this morning and it's a bug that could expose salted SHA512 encrypted passwords, plain-text security questions, encrypted answers, and other potential private account data from the Fedora Account System.
For exploiting the bug, a valid FAS account user would need to go log into a valid account, go to a group with unapproved members, and then manipulate the URL to get a JSON version of the account data for unapproved members in the list. The bug originated in 2008 while a hot-fix has now been deployed.
In reviewing their server logs they don't believe their production account system was ever exploited maliciously by this issue, but they are unable to confirm whether or not the staging version of FAS has been compromised. As a result, they suggest all Fedora FAS users change their private account information.
Full details on the Fedora Announce List.