GHSA-6wrc-864f-6vqp: Semantic MediaWiki 7.3.0 before 7.3.1 Missing Authorization via smwtask Update Task

Published Oct 27, 2026

Updated

Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask update task that allows users with edit rights to force semantic updates on arbitrary pages. Attackers can supply a serialized subject parameter for a restricted page to trigger forced reparsing, semantic-store writes, and resource-intensive dependency work.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Semantic MediaWiki to a version that resolves this vulnerability.
Fixed in 7.3.1

Event History

Oct 27, 2026

CVE Published

via OSV·10:23 AM

Data Sourced

via OSV·10:23 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A user with edit rights can exploit it. No higher privileges or user interaction are indicated.

What does an attacker need to provide to trigger the vulnerable behavior?

The attacker can supply a serialized subject parameter identifying a restricted page through the smwtask update task. This can force that page to be reparsed and trigger semantic-store writes and dependency processing.

Are pages the attacker cannot normally edit affected?

Yes. The issue allows a user with edit rights to force semantic updates on arbitrary pages, including restricted pages, through the update task.

What operational impact can exploitation cause?

Forced updates can cause resource-intensive dependency work, in addition to reparsing and writes to the semantic store. The provided impact metrics indicate low integrity and availability impact.

GHSA-6wrc-864f-6vqp: Semantic MediaWiki 7.3.0 before 7.3.1 Missing Authorization via smwtask Update Task

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to provide to trigger the vulnerable behavior?

Are pages the attacker cannot normally edit affected?

What operational impact can exploitation cause?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to provide to trigger the vulnerable behavior?

Are pages the attacker cannot normally edit affected?

What operational impact can exploitation cause?