Live › vulnerability › CVE-2026-116876
Go to dashboardSemantic MediaWiki from 2.5.0 before 7.3.1 lets any ordinary editor add an 'Is edit protected' annotation that sets indefinite edit and move restrictions on a page. The check that the author holds the right to protect pages is missing, so the editor locks out other editors and administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Wikis running Semantic MediaWiki between 2.5.0 and 7.3.1 are exposed, and the flaw only matters when is enabled. Wikis that do not enable that setting, or that already run 7.3.1 or later, can skip it. Wikis where untrusted or broadly granted editors can change pages are the ones most at risk.
$smwgEditProtectionRightNo product ranges from the sources yet.
mediawiki/semantic-media-wiki$smwgEditProtectionRight is set in LocalSettings.php (unknown if the sources do not say which default applies)7.3.1 or later$smwgEditProtectionRight disabled (unknown whether this fully closes the flaw)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Semantic MediaWiki from 2.5.0 before 7.3.1 contains an improper authorization vulnerability that allows ordinary editors to permanently protect pages by adding an Is edit protected annotation. When $smwgEditProtectionRight is enabled, EditProtectionUpdater applies indefinite edit and move restrictions without checking the author's rights, locking other editors and administrators out.
This page as .md · .json · in your agent: get_signal("CVE-2026-116876")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.