{"id":"CVE-2026-116873","kind":"vulnerability","aliases":["CVE-2026-116873"],"related":[],"title":"Semantic MediaWiki: smwtask API lets anonymous users run jobs and updates","description":"Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask API module that allows unauthenticated attackers to run queued jobs and force store updates. Attackers can use the public anonymous CSRF token with run-joblist to execute arbitrary job types in unbounded counts, or invoke update on sysop-protected pages, leaking page titles and exhausting resources.","summary":"Semantic MediaWiki 7.3.0 before 7.3.1 exposes its smwtask API module without authorization checks. An unauthenticated attacker can run queued jobs and force store updates, which leaks page titles and can exhaust server resources.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mediawiki","package","self-hosted","semantic-mediawiki","wiki"],"not_affected_if":["auth-required","managed-hosting"],"how_to_check":"- Check the installed Semantic MediaWiki version in Special:Version on the wiki, or in `composer show mediawiki/semantic-media-wiki` for Composer installs.\n- Confirm whether the wiki is running a version from `7.3.0` up to, but not including, `7.3.1`.","fix":"- Upgrade Semantic MediaWiki to `7.3.1` or later.\n- Until the upgrade is done, unknown whether restricting access to the smwtask API at the web server is a sufficient workaround.","status":"open","published_at":"2026-10-27T11:17:29+00:00","first_seen_at":"2026-10-27T11:31:27+00:00","triaged_at":"2026-10-27T11:31:49+00:00","updated_at":"2026-10-27T11:31:49+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T11:31:49Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Semantic MediaWiki to `7.3.1` or later.\n- Until the upgrade is done, unknown whether restricting access to the smwtask API at the web server is a sufficient workaround.","reach":"internet","title":"Semantic MediaWiki: smwtask API lets anonymous users run jobs and updates","impact":"medium","summary":"Semantic MediaWiki 7.3.0 before 7.3.1 exposes its smwtask API module without authorization checks. An unauthenticated attacker can run queued jobs and force store updates, which leaks page titles and can exhaust server resources.","category":"package","nicknames":[],"who_cares":["mediawiki","semantic-mediawiki","self-hosted","wiki"],"confidence":0.6,"needs_auth":"no","worst_case":"Anonymous users force job runs, leak page titles and exhaust resources","analyst_note":"Confirm the fixed version and whether a config-level workaround exists; check the Semantic MediaWiki release notes and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-116873.","how_to_check":"- Check the installed Semantic MediaWiki version in Special:Version on the wiki, or in `composer show mediawiki/semantic-media-wiki` for Composer installs.\n- Confirm whether the wiki is running a version from `7.3.0` up to, but not including, `7.3.1`.","needs_analyst":true,"not_affected_if":["managed-hosting","auth-required"],"who_is_affected":"Wikis running Semantic MediaWiki from 7.3.0 before 7.3.1 are exposed, because the smwtask API is reachable by anonymous users through the public CSRF token. Teams running a MediaWiki with Semantic MediaWiki installed on a public URL should check the version; private wikis that require login before any request are less exposed, though the sources do not say how the API behaves behind a login wall.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000689,"input_tokens":3369,"output_tokens":704,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116873':14A,17A '-2026':13A,16A '7.3.0':29B,63C '7.3.1':31B,65C 'allow':77C 'anonym':6A,93C 'api':4A,35B,74C 'arbitrari':102C 'attack':42B,79C,88C 'author':38B,69C 'check':39B 'contain':66C 'count':107C 'csrf':94C 'cve':12A,15A 'execut':101C 'exhaust':57B,120C 'expos':32B 'forc':48B,85C 'host':22B 'invok':109C 'job':9A,46B,83C,103C 'joblist':99C 'leak':52B,116C 'let':5A 'mediawiki':2A,18B,25B,28B,61C 'miss':68C 'modul':36B,75C 'packag':19B 'page':53B,115C,117C 'protect':114C 'public':92C 'queu':45B,82C 'resourc':59B,121C 'run':8A,44B,81C,98C 'run-joblist':97C 'self':21B 'self-host':20B 'semant':1A,24B,27B,60C 'semantic-mediawiki':23B 'server':58B 'smwtask':3A,34B,73C 'store':49B,86C 'sysop':113C 'sysop-protect':112C 'titl':54B,118C 'token':95C 'type':104C 'unauthent':41B,78C 'unbound':106C 'updat':11A,50B,87C,110C 'use':90C 'user':7A 'vulner':70C 'wiki':26B 'without':37B","nicknames":[],"mitigations":[],"who_affected":"Wikis running Semantic MediaWiki from 7.3.0 before 7.3.1 are exposed, because the smwtask API is reachable by anonymous users through the public CSRF token. Teams running a MediaWiki with Semantic MediaWiki installed on a public URL should check the version; private wikis that require login before any request are less exposed, though the sources do not say how the API behaves behind a login wall.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T11:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116873","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116873","severity":null,"published_at":"2026-10-27T11:17:29+00:00","modified_at":"2026-10-27T11:17:29+00:00","first_seen_at":"2026-10-27T11:31:27+00:00","fetched_at":"2026-10-27T11:31:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}