Missing Authorization Vulnerability in Semantic MediaWiki Affects Unauthenticated Users
CVE-2026-116890

6.9MEDIUM

Key Information:

Vendor

Semanticmediawiki

Status
Semanticmediawiki
Vendor
CVE Published:
27 October 2026

What is CVE-2026-116890?

Semantic MediaWiki versions prior to 7.3.0 are susceptible to a missing authorization vulnerability in the api.php smwtask module. This weakness allows unauthenticated attackers to execute admin-level maintenance tasks through the use of a public anonymous CSRF token. Attackers can exploit this vulnerability to access sensitive internal store statistics, enqueue various tasks such as smw.entityIdDisposer, and execute queued jobs. Such actions can lead to performance issues and compromise the integrity of semantic data within the application.

Affected Version(s)

SemanticMediaWiki 3.0.0 < 7.3.0

SemanticMediaWiki 7.3.0

References

https://github.com/SemanticMediaWiki/SemanticMediaWiki/se...
vendor-advisory
https://www.vulncheck.com/advisories/semantic-mediawiki-3...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.