GHSA-9824-67pm-c29j: Semantic MediaWiki 2.5.0 before 7.3.1 Missing Authorization via Is edit protected

Published Oct 27, 2026

Updated

Semantic MediaWiki from 2.5.0 before 7.3.1 contains an improper authorization vulnerability that allows ordinary editors to permanently protect pages by adding an Is edit protected annotation. When $smwgEditProtectionRight is enabled, EditProtectionUpdater applies indefinite edit and move restrictions without checking the author's rights, locking other editors and administrators out.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Semantic MediaWiki to a version that resolves this vulnerability.
Fixed in 7.3.1
Configuration
Disable $smwgEditProtectionRight to prevent EditProtectionUpdater from applying indefinite edit and move restrictions without checking the author's rights.
Semantic MediaWiki $smwgEditProtectionRight = disabled

Event History

Oct 27, 2026

CVE Published

via OSV·10:23 AM

Data Sourced

via OSV·10:23 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any ordinary editor who can add an "Is edit protected" annotation can trigger the restrictions. The issue does not require elevated protection or administrative rights.

Are installations affected by default?

The vulnerable behavior applies when $smwgEditProtectionRight is enabled. The provided information does not establish whether that setting is enabled by default.

What is the impact of successful exploitation?

An attacker can cause indefinite edit and move restrictions to be applied to pages. This can lock out other editors and administrators from modifying or moving the affected pages.

GHSA-9824-67pm-c29j: Semantic MediaWiki 2.5.0 before 7.3.1 Missing Authorization via Is edit protected

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Are installations affected by default?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are installations affected by default?

What is the impact of successful exploitation?