Missing Authorization in Semantic MediaWiki Allows Editors to Lock Pages

CVE-2026-126561

What is CVE-2026-126561?

Semantic MediaWiki is affected by a vulnerability that permits unauthorized editors to impose edit restrictions on pages by utilizing the 'Is edit protected' annotation. This flaw enables attackers to add the annotation [[Is edit protected::true]] to pages or set it through widely transcluded templates. Consequently, the TitleQuickPermissions hook inhibits legitimate editors and administrators from making modifications, relocating, or deleting these pages indefinitely. This poses a significant risk to content management and hampers collaborative editing efforts.

References