Missing Authorization Vulnerability in Semantic MediaWiki by Semantic MediaWiki
CVE-2026-116873

6.9MEDIUM

Key Information:

Vendor

Semanticmediawiki

Status
Semanticmediawiki
Vendor
CVE Published:
27 October 2026

What is CVE-2026-116873?

Semantic MediaWiki versions prior to 7.3.1 feature a missing authorization vulnerability within the smwtask API module. This flaw allows unauthenticated attackers to exploit the system by performing actions including running queued jobs and updating sysop-protected pages. By utilizing the publicly accessible anonymous CSRF token with the run-joblist function, attackers can execute arbitrary job types without limit, leading to potential resource exhaustion and leakage of sensitive information, particularly the titles of protected pages.

Affected Version(s)

SemanticMediaWiki 7.3.0 < 7.3.1

SemanticMediaWiki 7.3.1

References

https://github.com/SemanticMediaWiki/SemanticMediaWiki/se...
vendor-advisory
https://www.vulncheck.com/advisories/semantic-mediawiki-7...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

kemrec
.