CVE-2026-116879GHSA-6wrc-864f-6vqp
SemanticMediaWiki: Semantic MediaWiki 7.3.0 before 7.3.1 Missing Authorization via smwtask Update Task
SemanticMediaWiki SemanticMediaWiki
CVSS
6.9MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 7.3.1SemanticMediaWikiCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask update task that allows users with edit rights to force semantic updates on arbitrary pages. Attackers can supply a serialized subject parameter for a restricted page to trigger forced reparsing, semantic-store writes, and resource-intensive dependency work.
Text from CVE List
Affected versions 2
- SemanticMediaWikiaffected: 7.3.0 before 7.3.1CVE List
- SemanticMediaWikiunaffected: 7.3.1CVE List
References 3
- github.com/SemanticMediaWiki/SemanticMediaWiki/commit/cba0541d1f931e5c5440a483790dd7c3dec1751dFixvia CVE List
- github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-6wrc-864f-6vqpAdvisoryvia CVE List
- vulncheck.com/advisories/semantic-mediawiki-7.3.0-before-7.3.1-missing-authorization-via-smwtask-update-taskAdvisoryvia CVE List