Live › vulnerability › CVE-2026-116880
Go to dashboardSemantic MediaWiki versions from 3.0.0 before 7.3.1 overwrite the edit token on Special:SMWAdmin with a freshly generated valid one, which defeats the cross-site request forgery check. An attacker can lure a logged-in smw-admin user to a malicious page that triggers schema setup, entity disposal or job actions, causing semantic data loss and resource exhaustion.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Wikis running Semantic MediaWiki between 3.0.0 and 7.2.x that have users in the smw-admin group, since the attack needs a logged-in administrator to visit a malicious page. Sites without SMW or without smw-admin users are not exposed to this path.
No product ranges from the sources yet.
composer.lock for mediawiki/semantic-media-wiki; versions from 3.0.0 up to but not including 7.3.1 are affected.7.3.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Special:SMWAdmin because it overwrites the wpEditToken with a freshly generated valid token. Attackers can lure an authenticated smw-admin user to a malicious page that triggers schema setup, entity-disposal, or job actions, causing semantic data loss and resource exhaustion.
This page as .md · .json · in your agent: get_signal("CVE-2026-116880")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.