Live › vulnerability › CVE-2026-116890
Go to dashboardSemantic MediaWiki versions from 3.0.0 before 7.3.0 expose the api.php smwtask module without an authorization check. An anonymous attacker can use the public CSRF token to read store statistics, queue jobs such as smw.entityIdDisposer, and run queued jobs, which degrades performance and can alter semantic data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Wikis running Semantic MediaWiki from 3.0.0 up to but not including 7.3.0 that expose api.php to the internet are exposed, since the flaw is reachable without logging in. Wikis on versions 7.3.0 or later, or private wikis not reachable from outside, have less exposure.
No product ranges from the sources yet.
3.0.0 and below 7.3.0.7.3.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics, enqueue jobs like smw.entityIdDisposer, and execute queued jobs, degrading performance and altering semantic data.
This page as .md · .json · in your agent: get_signal("CVE-2026-116890")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.