All vulnerabilities
CVE-2026-116890GHSA-jr78-w6w5-m8f8

SemanticMediaWiki: Semantic MediaWiki 3.0.0 before 7.3.0 Missing Authorization via smwtask API

SemanticMediaWiki SemanticMediaWikiPackagistLibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in7.3.0Fixed versionCVE List
Published27 Oct 2026Updated 27 Oct 2026CVE List

What fixes it

  • 7.3.0SemanticMediaWikiCVE List
  • 7.3.0mediawiki/semantic-media-wiki, PackagistOSVcomposer require "mediawiki/semantic-media-wiki:^7.3.0"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics, enqueue jobs like smw.entityIdDisposer, and execute queued jobs, degrading performance and altering semantic data.

Text from CVE List

Affected versions 38

  • SemanticMediaWikiaffected: 3.0.0 before 7.3.0CVE List
  • SemanticMediaWikiunaffected: 7.3.0CVE List
  • mediawiki/semantic-media-wiki, Packagistfrom 3.0.0, fixed in 7.3.0OSV
  • mediawiki/semantic-media-wiki, Packagist3.0.0OSV
  • mediawiki/semantic-media-wiki, Packagist3.0.1OSV
  • mediawiki/semantic-media-wiki, Packagist3.0.2OSV
  • mediawiki/semantic-media-wiki, Packagist3.1.0OSV
  • mediawiki/semantic-media-wiki, Packagist3.1.0-rc.1OSV
  • mediawiki/semantic-media-wiki, Packagist3.1.1OSV
  • mediawiki/semantic-media-wiki, Packagist3.1.2OSV
  • mediawiki/semantic-media-wiki, Packagist3.1.3OSV
  • mediawiki/semantic-media-wiki, Packagist3.1.4OSV
  • mediawiki/semantic-media-wiki, Packagist3.1.5OSV
  • mediawiki/semantic-media-wiki, Packagist3.1.6OSV
  • mediawiki/semantic-media-wiki, Packagist3.2.0OSV
  • mediawiki/semantic-media-wiki, Packagist3.2.0-rc.1OSV
  • mediawiki/semantic-media-wiki, Packagist3.2.0-rc.2OSV
  • mediawiki/semantic-media-wiki, Packagist3.2.1OSV
  • mediawiki/semantic-media-wiki, Packagist3.2.2OSV
  • mediawiki/semantic-media-wiki, Packagist3.2.3OSV
  • mediawiki/semantic-media-wiki, Packagist4.0.0OSV
  • mediawiki/semantic-media-wiki, Packagist4.0.1OSV
  • mediawiki/semantic-media-wiki, Packagist4.0.2OSV
  • mediawiki/semantic-media-wiki, Packagist4.1.0OSV
  • mediawiki/semantic-media-wiki, Packagist4.1.1OSV
  • mediawiki/semantic-media-wiki, Packagist4.1.2OSV
  • mediawiki/semantic-media-wiki, Packagist4.1.3OSV
  • mediawiki/semantic-media-wiki, Packagist4.2.0OSV
  • mediawiki/semantic-media-wiki, Packagist5.0.0OSV
  • mediawiki/semantic-media-wiki, Packagist5.0.1OSV
  • mediawiki/semantic-media-wiki, Packagist5.0.2OSV
  • mediawiki/semantic-media-wiki, Packagist5.1.0OSV
  • mediawiki/semantic-media-wiki, Packagist6.0.0OSV
  • mediawiki/semantic-media-wiki, Packagist6.0.1OSV
  • mediawiki/semantic-media-wiki, Packagist7.0.0OSV
  • mediawiki/semantic-media-wiki, Packagist7.1.0OSV
  • mediawiki/semantic-media-wiki, Packagist7.2.0OSV
  • mediawiki/semantic-media-wiki, Packagist7.2.1OSV

References 2