CVE-2026-116876GHSA-9824-67pm-c29j
SemanticMediaWiki: Semantic MediaWiki 2.5.0 before 7.3.1 Missing Authorization via Is edit protected
SemanticMediaWiki SemanticMediaWiki
CVSS
7.1HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 7.3.1SemanticMediaWikiCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Semantic MediaWiki from 2.5.0 before 7.3.1 contains an improper authorization vulnerability that allows ordinary editors to permanently protect pages by adding an Is edit protected annotation. When $smwgEditProtectionRight is enabled, EditProtectionUpdater applies indefinite edit and move restrictions without checking the author's rights, locking other editors and administrators out.
Text from CVE List
Affected versions 2
- SemanticMediaWikiaffected: 2.5.0 before 7.3.1CVE List
- SemanticMediaWikiunaffected: 7.3.1CVE List
References 3
- github.com/SemanticMediaWiki/SemanticMediaWiki/commit/d2a198f42184373bb8604450c46a13a2c28eafa3Fixvia CVE List
- github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-9824-67pm-c29jAdvisoryvia CVE List
- vulncheck.com/advisories/semantic-mediawiki-2.5.0-before-7.3.1-missing-authorization-via-is-edit-protectedAdvisoryvia CVE List