{"id":"CVE-2026-116879","kind":"vulnerability","aliases":["CVE-2026-116879"],"related":[],"title":"Semantic MediaWiki: users with edit rights can force updates on restricted pages","description":"Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask update task that allows users with edit rights to force semantic updates on arbitrary pages. Attackers can supply a serialized subject parameter for a restricted page to trigger forced reparsing, semantic-store writes, and resource-intensive dependency work.","summary":"Semantic MediaWiki 7.3.0 before 7.3.1 has a missing authorization check in its smwtask update task. A user with edit rights can force semantic updates on arbitrary pages, including restricted ones, which triggers reparsing, semantic-store writes and heavy dependency work.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mediawiki","package","self-hosted","semantic-mediawiki"],"not_affected_if":["read-only-wiki","smw-not-7.3.0"],"how_to_check":"- Check the installed Semantic MediaWiki version in Special:Version on the wiki, or in `composer.lock` for the `mediawiki/semantic-media-wiki` package.\n- Confirm whether the wiki runs SMW 7.3.0 specifically.","fix":"- Upgrade Semantic MediaWiki to `7.3.1` or later.","status":"open","published_at":"2026-10-27T11:17:29+00:00","first_seen_at":"2026-10-27T11:31:27+00:00","triaged_at":"2026-10-27T11:31:54+00:00","updated_at":"2026-10-27T11:31:54+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T11:31:54Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Semantic MediaWiki to `7.3.1` or later.","reach":"network","title":"Semantic MediaWiki: users with edit rights can force updates on restricted pages","impact":"low","summary":"Semantic MediaWiki 7.3.0 before 7.3.1 has a missing authorization check in its smwtask update task. A user with edit rights can force semantic updates on arbitrary pages, including restricted ones, which triggers reparsing, semantic-store writes and heavy dependency work.","category":"package","nicknames":[],"who_cares":["semantic-mediawiki","mediawiki","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Authenticated editors trigger heavy reparsing and semantic-store writes on restricted pages.","analyst_note":"","how_to_check":"- Check the installed Semantic MediaWiki version in Special:Version on the wiki, or in `composer.lock` for the `mediawiki/semantic-media-wiki` package.\n- Confirm whether the wiki runs SMW 7.3.0 specifically.","needs_analyst":false,"not_affected_if":["smw-not-7.3.0","read-only-wiki"],"who_is_affected":"Wikis running Semantic MediaWiki 7.3.0 that let users with edit rights make changes. The exposure is limited to wikis with SMW 7.3.0 installed; the sources do not describe any extra configuration that is required. Wikis on other SMW versions, or on 7.3.1 and later, are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000622,"input_tokens":3353,"output_tokens":574,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116879':15A,18A '-2026':14A,17A '7.3.0':29B,71C '7.3.1':31B,73C 'allow':85C 'arbitrari':52B,95C 'attack':97C 'author':35B,77C 'check':36B 'contain':74C 'cve':13A,16A 'depend':66B,120C 'edit':5A,45B,88C 'forc':8A,48B,91C,110C 'heavi':65B 'host':23B 'includ':54B 'intens':119C 'mediawiki':2A,19B,26B,28B,69C 'miss':34B,76C 'one':56B 'packag':20B 'page':12A,53B,96C,107C 'paramet':103C 'repars':59B,111C 'resourc':118C 'resource-intens':117C 'restrict':11A,55B,106C 'right':6A,46B,89C 'self':22B 'self-host':21B 'semant':1A,25B,27B,49B,61B,68C,92C,113C 'semantic-mediawiki':24B 'semantic-stor':60B,112C 'serial':101C 'smwtask':39B,81C 'store':62B,114C 'subject':102C 'suppli':99C 'task':41B,83C 'trigger':58B,109C 'updat':9A,40B,50B,82C,93C 'user':3A,43B,86C 'vulner':78C 'work':67B,121C 'write':63B,115C","nicknames":[],"mitigations":[],"who_affected":"Wikis running Semantic MediaWiki 7.3.0 that let users with edit rights make changes. The exposure is limited to wikis with SMW 7.3.0 installed; the sources do not describe any extra configuration that is required. Wikis on other SMW versions, or on 7.3.1 and later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T11:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116879","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116879","severity":null,"published_at":"2026-10-27T11:17:29+00:00","modified_at":"2026-10-27T11:17:29+00:00","first_seen_at":"2026-10-27T11:31:27+00:00","fetched_at":"2026-10-27T11:31:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}