CVE-2026-116876: Semantic MediaWiki 2.5.0 before 7.3.1 Missing Authorization via Is edit protected
Semantic MediaWiki from 2.5.0 before 7.3.1 contains an improper authorization vulnerability that allows ordinary editors to permanently protect pages by adding an Is edit protected annotation. When $smwgEditProtectionRight is enabled, EditProtectionUpdater applies indefinite edit and move restrictions without checking the author's rights, locking other editors and administrators out.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Semantic MediaWikito a version that resolves this vulnerability.Fixed in 7.3.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An ordinary editor can exploit it if they can add an "Is edit protected" annotation and the $smwgEditProtectionRight setting is enabled.
Are default deployments affected?
The issue depends on $smwgEditProtectionRight being enabled. The provided information does not state whether that setting is enabled by default.
What is the practical impact of exploitation?
A malicious editor can apply indefinite edit and move restrictions to pages, potentially locking out other editors and administrators.
Which versions need remediation?
Semantic MediaWiki versions from 2.5.0 before 7.3.1 are affected. Upgrading to 7.3.1 or later addresses the affected version range.