{"id":"CVE-2026-116890","kind":"vulnerability","aliases":["CVE-2026-116890"],"related":[],"title":"Semantic MediaWiki: unauthenticated users can run admin maintenance tasks via API","description":"Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics, enqueue jobs like smw.entityIdDisposer, and execute queued jobs, degrading performance and altering semantic data.","summary":"Semantic MediaWiki versions from 3.0.0 before 7.3.0 expose the api.php smwtask module without an authorization check. An anonymous attacker can use the public CSRF token to read store statistics, queue jobs such as smw.entityIdDisposer, and run queued jobs, which degrades performance and can alter semantic data.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mediawiki","package","self-hosted","semantic-mediawiki"],"not_affected_if":["private-network-only","version-7.3.0-or-later"],"how_to_check":"- Check the installed Semantic MediaWiki version in Special:Version or the extension's composer/extension.json; affected if it is at least `3.0.0` and below `7.3.0`.\n- unknown for other checks; the sources do not name a specific setting or log entry.","fix":"- Upgrade Semantic MediaWiki to `7.3.0` or later.\n- unknown for interim mitigations; the sources do not describe one.","status":"open","published_at":"2026-10-27T11:17:31+00:00","first_seen_at":"2026-10-27T11:31:27+00:00","triaged_at":"2026-10-27T11:31:46+00:00","updated_at":"2026-10-27T11:31:46+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T11:31:46Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Semantic MediaWiki to `7.3.0` or later.\n- unknown for interim mitigations; the sources do not describe one.","reach":"internet","title":"Semantic MediaWiki: unauthenticated users can run admin maintenance tasks via API","impact":"medium","summary":"Semantic MediaWiki versions from 3.0.0 before 7.3.0 expose the api.php smwtask module without an authorization check. An anonymous attacker can use the public CSRF token to read store statistics, queue jobs such as smw.entityIdDisposer, and run queued jobs, which degrades performance and can alter semantic data.","category":"package","nicknames":[],"who_cares":["mediawiki","semantic-mediawiki","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Anonymous users can alter semantic data and degrade wiki performance","analyst_note":"Confirm the affected version range and whether a patch or workaround exists beyond 7.3.0 by checking the upstream Semantic MediaWiki release notes and the NVD entry.","how_to_check":"- Check the installed Semantic MediaWiki version in Special:Version or the extension's composer/extension.json; affected if it is at least `3.0.0` and below `7.3.0`.\n- unknown for other checks; the sources do not name a specific setting or log entry.","needs_analyst":true,"not_affected_if":["version-7.3.0-or-later","private-network-only"],"who_is_affected":"Wikis running Semantic MediaWiki from 3.0.0 up to but not including 7.3.0 that expose api.php to the internet are exposed, since the flaw is reachable without logging in. Wikis on versions 7.3.0 or later, or private wikis not reachable from outside, have less exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000666,"input_tokens":3371,"output_tokens":658,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116890':14A,17A '-2026':13A,16A '3.0.0':30B,75C '7.3.0':32B,77C 'admin':7A,95C 'admin-on':94C 'allow':89C 'alter':69B,123C 'anonym':43B,104C 'api':11A 'api.php':35B,85C 'attack':44B,91C,99C 'author':40B,81C 'check':41B 'contain':78C 'csrf':49B,105C 'cve':12A,15A 'data':71B,125C 'degrad':65B,120C 'enqueu':112C 'execut':117C 'expos':33B 'host':22B 'intern':109C 'job':56B,63B,113C,119C 'like':114C 'mainten':8A,97C 'mediawiki':2A,18B,25B,27B,73C 'miss':80C 'modul':37B,87C 'packag':19B 'perform':66B,121C 'public':48B,103C 'queu':62B,118C 'queue':55B 'read':52B,108C 'run':6A,61B,93C 'self':21B 'self-host':20B 'semant':1A,24B,26B,70B,72C,124C 'semantic-mediawiki':23B 'smw.entityiddisposer':59B,115C 'smwtask':36B,86C 'statist':54B,111C 'store':53B,110C 'task':9A,98C 'token':50B,106C 'unauthent':3A,90C 'use':46B,101C 'user':4A 'version':28B 'via':10A 'vulner':82C 'without':38B","nicknames":[],"mitigations":[],"who_affected":"Wikis running Semantic MediaWiki from 3.0.0 up to but not including 7.3.0 that expose api.php to the internet are exposed, since the flaw is reachable without logging in. Wikis on versions 7.3.0 or later, or private wikis not reachable from outside, have less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T11:17:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116890","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116890","severity":null,"published_at":"2026-10-27T11:17:31+00:00","modified_at":"2026-10-27T11:17:31+00:00","first_seen_at":"2026-10-27T11:31:27+00:00","fetched_at":"2026-10-27T11:31:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}