---
id: "CVE-2026-116873"
kind: "vulnerability"
aliases: ["CVE-2026-116873"]
title: "Semantic MediaWiki: smwtask API lets anonymous users run jobs and updates"
severity: "high"
cvss: 7.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mediawiki", "package", "self-hosted", "semantic-mediawiki", "wiki"]
not_affected_if: ["auth-required", "managed-hosting"]
published_at: "2026-10-27T11:17:29+00:00"
first_seen_at: "2026-10-27T11:31:27+00:00"
updated_at: "2026-10-27T11:31:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116873", "first_seen_at": "2026-10-27T11:31:27+00:00"}]
---

# Semantic MediaWiki: smwtask API lets anonymous users run jobs and updates

Semantic MediaWiki 7.3.0 before 7.3.1 exposes its smwtask API module without authorization checks. An unauthenticated attacker can run queued jobs and force store updates, which leaks page titles and can exhaust server resources.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Semantic MediaWiki version in Special:Version on the wiki, or in `composer show mediawiki/semantic-media-wiki` for Composer installs.
- Confirm whether the wiki is running a version from `7.3.0` up to, but not including, `7.3.1`.

## Fix

- Upgrade Semantic MediaWiki to `7.3.1` or later.
- Until the upgrade is done, unknown whether restricting access to the smwtask API at the web server is a sufficient workaround.

## Timeline

- 2026-10-27T11:31:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116873

## From the sources

Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask API module that allows unauthenticated attackers to run queued jobs and force store updates. Attackers can use the public anonymous CSRF token with run-joblist to execute arbitrary job types in unbounded counts, or invoke update on sysop-protected pages, leaking page titles and exhausting resources.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_