---
id: "CVE-2026-116890"
kind: "vulnerability"
aliases: ["CVE-2026-116890"]
title: "Semantic MediaWiki: unauthenticated users can run admin maintenance tasks via API"
severity: "high"
cvss: 7.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mediawiki", "package", "self-hosted", "semantic-mediawiki"]
not_affected_if: ["private-network-only", "version-7.3.0-or-later"]
published_at: "2026-10-27T11:17:31+00:00"
first_seen_at: "2026-10-27T11:31:27+00:00"
updated_at: "2026-10-27T11:31:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116890", "first_seen_at": "2026-10-27T11:31:27+00:00"}]
---

# Semantic MediaWiki: unauthenticated users can run admin maintenance tasks via API

Semantic MediaWiki versions from 3.0.0 before 7.3.0 expose the api.php smwtask module without an authorization check. An anonymous attacker can use the public CSRF token to read store statistics, queue jobs such as smw.entityIdDisposer, and run queued jobs, which degrades performance and can alter semantic data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Semantic MediaWiki version in Special:Version or the extension's composer/extension.json; affected if it is at least `3.0.0` and below `7.3.0`.
- unknown for other checks; the sources do not name a specific setting or log entry.

## Fix

- Upgrade Semantic MediaWiki to `7.3.0` or later.
- unknown for interim mitigations; the sources do not describe one.

## Timeline

- 2026-10-27T11:31:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116890

## From the sources

Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics, enqueue jobs like smw.entityIdDisposer, and execute queued jobs, degrading performance and altering semantic data.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_