CVE-2026-116879: Semantic MediaWiki 7.3.0 before 7.3.1 Missing Authorization via smwtask Update Task
Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask update task that allows users with edit rights to force semantic updates on arbitrary pages. Attackers can supply a serialized subject parameter for a restricted page to trigger forced reparsing, semantic-store writes, and resource-intensive dependency work.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Semantic MediaWikito a version that resolves this vulnerability.Fixed in 7.3.1
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with edit rights can exploit it. The attacker does not need interaction from another user and can target pages that are otherwise restricted.
What does exploitation allow an attacker to do?
An attacker can provide a serialized subject parameter for a restricted page to force it to be reparsed and to trigger semantic-store writes. This can also cause resource-intensive dependency processing, affecting availability.
Which versions are affected?
Semantic MediaWiki 7.3.0 is affected. The issue is fixed in version 7.3.1.