Live › vulnerability › CVE-2026-116873
Go to dashboardSemantic MediaWiki 7.3.0 before 7.3.1 exposes its smwtask API module without authorization checks. An unauthenticated attacker can run queued jobs and force store updates, which leaks page titles and can exhaust server resources.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Wikis running Semantic MediaWiki from 7.3.0 before 7.3.1 are exposed, because the smwtask API is reachable by anonymous users through the public CSRF token. Teams running a MediaWiki with Semantic MediaWiki installed on a public URL should check the version; private wikis that require login before any request are less exposed, though the sources do not say how the API behaves behind a login wall.
No product ranges from the sources yet.
composer show mediawiki/semantic-media-wiki for Composer installs.7.3.0 up to, but not including, 7.3.1.7.3.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask API module that allows unauthenticated attackers to run queued jobs and force store updates. Attackers can use the public anonymous CSRF token with run-joblist to execute arbitrary job types in unbounded counts, or invoke update on sysop-protected pages, leaking page titles and exhausting resources.
This page as .md · .json · in your agent: get_signal("CVE-2026-116873")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.