CVE-2026-126566: Semantic MediaWiki 7.3.1 before 7.4.1 Incorrect Authorization via Edit Protection Annotations

Q: Who can exploit this issue?

An editor who can modify a transcluded template can add the {{#set:Is edit protected=false}} annotation. The vulnerable authorization check evaluates protection changes against the latest revision author rather than the administrator who applied the protection.

Q: What protections can be removed?

The issue can remove administrator edit protection and move protection when those protections are logged under the administrator's name.

Q: Which versions are affected and what version fixes it?

Semantic MediaWiki 7.3.1 before 7.4.1 is affected. Upgrade to version 7.4.1 or later.

Q: How can I check whether exploitation may have occurred?

Review transcluded templates for {{#set:Is edit protected=false}} and examine protection and move-protection changes, particularly where administrator-applied protections were removed.

Published Nov 11, 2026

Updated

Semantic MediaWiki 7.3.1 before 7.4.1 contains an incorrect authorization vulnerability in EditProtectionUpdater::userMayChangeProtection() that checks protection changes against the page's latest revision author. Editors can add {{#set:Is edit protected=false}} to a transcluded template, removing administrator edit and move protection logged under the administrator's name.

Affected Software

1 affected component

Semantic MediaWiki Semantic MediaWiki>=7.3.1<7.4.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Semantic MediaWiki to a version that resolves this vulnerability.
Fixed in 7.4.1

Event History

Nov 11, 2026

CVE Published

via MITRE·02:36 AM

Data Sourced

via MITRE·02:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An editor who can modify a transcluded template can add the {{#set:Is edit protected=false}} annotation. The vulnerable authorization check evaluates protection changes against the latest revision author rather than the administrator who applied the protection.

What protections can be removed?

The issue can remove administrator edit protection and move protection when those protections are logged under the administrator's name.

Which versions are affected and what version fixes it?

Semantic MediaWiki 7.3.1 before 7.4.1 is affected. Upgrade to version 7.4.1 or later.

How can I check whether exploitation may have occurred?

Review transcluded templates for {{#set:Is edit protected=false}} and examine protection and move-protection changes, particularly where administrator-applied protections were removed.

CVE-2026-126566: Semantic MediaWiki 7.3.1 before 7.4.1 Incorrect Authorization via Edit Protection Annotations

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What protections can be removed?

Which versions are affected and what version fixes it?

How can I check whether exploitation may have occurred?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What protections can be removed?

Which versions are affected and what version fixes it?

How can I check whether exploitation may have occurred?