GHSA-rjqv-6r83-pg8v: Semantic MediaWiki 7.3.0 Missing Authorization via smwtask API run-joblist and update

Published Oct 27, 2026

Updated

Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask API module that allows unauthenticated attackers to run queued jobs and force store updates. Attackers can use the public anonymous CSRF token with run-joblist to execute arbitrary job types in unbounded counts, or invoke update on sysop-protected pages, leaking page titles and exhausting resources.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Semantic MediaWiki to a version that resolves this vulnerability.
Fixed in 7.3.1

Event History

Oct 27, 2026

CVE Published

via OSV·10:23 AM

Data Sourced

via OSV·10:23 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to unauthenticated exploitation?

Semantic MediaWiki 7.3.0 deployments are affected before upgrading to 7.3.1. The issue is remotely reachable without authentication and does not require user interaction.

What can an unauthenticated attacker do?

An attacker can use the public anonymous CSRF token with smwtask run-joblist to run arbitrary queued job types with unbounded counts. They can also invoke update on sysop-protected pages, which can leak page titles and exhaust resources.

What should be prioritized during triage?

Prioritize systems where the smwtask API is reachable by untrusted network users, since exploitation requires no account or special privileges. Investigate unexpected job execution volume, repeated run-joblist requests, store update activity, resource exhaustion, and requests involving sysop-protected pages.

GHSA-rjqv-6r83-pg8v: Semantic MediaWiki 7.3.0 Missing Authorization via smwtask API run-joblist and update

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to unauthenticated exploitation?

What can an unauthenticated attacker do?

What should be prioritized during triage?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to unauthenticated exploitation?

What can an unauthenticated attacker do?

What should be prioritized during triage?