Live › vulnerability › CVE-2026-116879
Go to dashboardSemantic MediaWiki 7.3.0 before 7.3.1 has a missing authorization check in its smwtask update task. A user with edit rights can force semantic updates on arbitrary pages, including restricted ones, which triggers reparsing, semantic-store writes and heavy dependency work.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Wikis running Semantic MediaWiki 7.3.0 that let users with edit rights make changes. The exposure is limited to wikis with SMW 7.3.0 installed; the sources do not describe any extra configuration that is required. Wikis on other SMW versions, or on 7.3.1 and later, are not affected.
No product ranges from the sources yet.
composer.lock for the mediawiki/semantic-media-wiki package.7.3.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask update task that allows users with edit rights to force semantic updates on arbitrary pages. Attackers can supply a serialized subject parameter for a restricted page to trigger forced reparsing, semantic-store writes, and resource-intensive dependency work.
This page as .md · .json · in your agent: get_signal("CVE-2026-116879")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.