CVE-2026-126561 · Package
NO FIX YET · SEE WHAT TO DO
Semantic MediaWiki before 7.4.1 lets an editor without the edit-protection right add an Is edit protected annotation to a page. The page then blocks other editors and administrators from editing, moving or deleting it, indefinitely.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Wikis running Semantic MediaWiki from 2.5.0 up to but not including 7.4.1 that let non-privileged editors write semantic annotations. Sites where only trusted users can edit, or where the extension is not installed, can skip it.
Not affected if not-installed, trusted-editors-only
Who cares mediawiki, self-hosted, semantic-mediawiki
7.4.1 or later is not affected.7.4.1 or later.Semantic MediaWiki 2.5.0 before 7.4.1 contains a missing authorization vulnerability that allows editors without the edit-protection right to lock pages by adding an Is edit protected annotation. Attackers can add [[Is edit protected::true]] to pages or #set it in widely transcluded templates, so the TitleQuickPermissions hook blocks other editors and administrators from editing, moving or deleting them indefinitely.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.