CVE-2026-116890: Semantic MediaWiki 3.0.0 before 7.3.0 Missing Authorization via smwtask API
Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics, enqueue jobs like smw.entityIdDisposer, and execute queued jobs, degrading performance and altering semantic data.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Semantic MediaWiki versions from 3.0.0 up to, but not including, 7.3.0 are affected. The vulnerable functionality is the smwtask module in api.php.
Does exploitation require an account or user interaction?
No. The issue can be exploited by an unauthenticated attacker, and the supplied vector indicates no privileges or user interaction are required.
What could an attacker do through the affected API module?
An attacker can obtain internal store statistics, enqueue maintenance jobs such as smw.entityIdDisposer, and execute queued jobs. This can degrade performance and alter semantic data.
How can I determine whether my instance is potentially affected?
Check the installed Semantic MediaWiki version and whether api.php exposes the smwtask module. Versions before 7.3.0 within the stated affected range should be treated as vulnerable.