CVE-2026-116873: Semantic MediaWiki 7.3.0 Missing Authorization via smwtask API run-joblist and update
Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask API module that allows unauthenticated attackers to run queued jobs and force store updates. Attackers can use the public anonymous CSRF token with run-joblist to execute arbitrary job types in unbounded counts, or invoke update on sysop-protected pages, leaking page titles and exhausting resources.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Semantic MediaWikito a version that resolves this vulnerability.Fixed in 7.3.1
Event History
Frequently Asked Questions
Which deployments are affected?
Semantic MediaWiki 7.3.0 is affected. The issue is fixed in 7.3.1, so versions before 7.3.1 within the stated affected range require remediation.
Does exploitation require an account or user interaction?
No. An unauthenticated attacker can use a public anonymous CSRF token; no credentials or user interaction are required.
What can an attacker do through the vulnerable API module?
An attacker can use run-joblist to execute arbitrary queued job types in unbounded counts, which can exhaust resources. They can also invoke update on sysop-protected pages, forcing store updates and leaking page titles.
What should be prioritized if the instance cannot be patched immediately?
Restrict unauthenticated access to the smwtask API module where possible, particularly the run-joblist and update actions. This reduces exposure to anonymous requests that trigger jobs or store updates.