All vulnerabilities
CVE-2026-116873GHSA-rjqv-6r83-pg8v

SemanticMediaWiki: Semantic MediaWiki 7.3.0 Missing Authorization via smwtask API run-joblist and update

SemanticMediaWiki SemanticMediaWiki
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in7.3.1Fixed versionCVE List
Published27 Oct 2026Updated 27 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask API module that allows unauthenticated attackers to run queued jobs and force store updates. Attackers can use the public anonymous CSRF token with run-joblist to execute arbitrary job types in unbounded counts, or invoke update on sysop-protected pages, leaking page titles and exhausting resources.

Text from CVE List

Affected versions 2

  • SemanticMediaWikiaffected: 7.3.0 before 7.3.1CVE List
  • SemanticMediaWikiunaffected: 7.3.1CVE List

References 2