{"id":"CVE-2026-126561","kind":"vulnerability","aliases":["CVE-2026-126561"],"related":[],"title":"Semantic MediaWiki: editors can lock pages without edit-protection rights","description":"Semantic MediaWiki 2.5.0 before 7.4.1 contains a missing authorization vulnerability that allows editors without the edit-protection right to lock pages by adding an Is edit protected annotation. Attackers can add [[Is edit protected::true]] to pages or #set it in widely transcluded templates, so the TitleQuickPermissions hook blocks other editors and administrators from editing, moving or deleting them indefinitely.","summary":"Semantic MediaWiki before 7.4.1 lets an editor without the edit-protection right add an Is edit protected annotation to a page. The page then blocks other editors and administrators from editing, moving or deleting it, indefinitely.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mediawiki","package","self-hosted","semantic-mediawiki"],"not_affected_if":["not-installed","trusted-editors-only"],"how_to_check":"- Check the installed Semantic MediaWiki version in Special:Version or the extension's composer.json; `7.4.1` or later is not affected.\n- Look for the Is edit protected property used on pages or in templates.","fix":"- Semantic MediaWiki: move to `7.4.1` or later.","status":"open","published_at":"2026-11-11T03:16:50+00:00","first_seen_at":"2026-11-11T03:24:59+00:00","triaged_at":"2026-11-11T03:26:21+00:00","updated_at":"2026-11-11T03:26:21+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T03:26:21Z","model":"claude-haiku-5-5","output":{"fix":"- Semantic MediaWiki: move to `7.4.1` or later.","reach":"network","title":"Semantic MediaWiki: editors can lock pages without edit-protection rights","impact":"medium","summary":"Semantic MediaWiki before 7.4.1 lets an editor without the edit-protection right add an Is edit protected annotation to a page. The page then blocks other editors and administrators from editing, moving or deleting it, indefinitely.","audience":"businesses","category":"package","nicknames":[],"who_cares":["mediawiki","semantic-mediawiki","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Pages are locked against other editors and administrators indefinitely","analyst_note":"","how_to_check":"- Check the installed Semantic MediaWiki version in Special:Version or the extension's composer.json; `7.4.1` or later is not affected.\n- Look for the Is edit protected property used on pages or in templates.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["not-installed","trusted-editors-only"],"who_is_affected":"Wikis running Semantic MediaWiki from 2.5.0 up to but not including 7.4.1 that let non-privileged editors write semantic annotations. Sites where only trusted users can edit, or where the extension is not installed, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000731,"input_tokens":4673,"output_tokens":527,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126561':14A,17A '-2026':13A,16A '2.5.0':65C '7.4.1':29B,67C 'add':39B,86C,94C 'administr':55B,116C 'allow':74C 'annot':44B,91C 'attack':92C 'author':71C 'block':51B,112C 'contain':68C 'cve':12A,15A 'delet':60B,121C 'edit':9A,36B,42B,57B,79C,89C,96C,118C 'edit-protect':8A,35B,78C 'editor':3A,32B,53B,75C,114C 'hook':111C 'host':22B 'indefinit':62B,123C 'let':30B 'lock':5A,83C 'mediawiki':2A,18B,25B,27B,64C 'miss':70C 'move':58B,119C 'packag':19B 'page':6A,47B,49B,84C,100C 'protect':10A,37B,43B,80C,90C,97C 'right':11A,38B,81C 'self':21B 'self-host':20B 'semant':1A,24B,26B,63C 'semantic-mediawiki':23B 'set':102C 'templat':107C 'titlequickpermiss':110C 'transclud':106C 'true':98C 'vulner':72C 'wide':105C 'without':7A,33B,76C","nicknames":[],"mitigations":[],"who_affected":"Wikis running Semantic MediaWiki from 2.5.0 up to but not including 7.4.1 that let non-privileged editors write semantic annotations. Sites where only trusted users can edit, or where the extension is not installed, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","mediawiki","package","selfhosted","semanticmediawiki"],"campaign_type":null,"search_a":"'-126561':14A,17A '-2026':13A,16A 'cve':12A,15A 'edit':9A 'edit-protect':8A 'editor':3A 'lock':5A 'mediawiki':2A 'page':6A 'protect':10A 'right':11A 'semant':1A 'without':7A","search_b":"'7.4.1':29B 'add':39B 'administr':55B 'annot':44B 'block':51B 'delet':60B 'edit':36B,42B,57B 'edit-protect':35B 'editor':32B,53B 'host':22B 'indefinit':62B 'let':30B 'mediawiki':18B,25B,27B 'move':58B 'packag':19B 'page':47B,49B 'protect':37B,43B 'right':38B 'self':21B 'self-host':20B 'semant':24B,26B 'semantic-mediawiki':23B 'without':33B","search_c":"'2.5.0':65C '7.4.1':67C 'add':86C,94C 'administr':116C 'allow':74C 'annot':91C 'attack':92C 'author':71C 'block':112C 'contain':68C 'delet':121C 'edit':79C,89C,96C,118C 'edit-protect':78C 'editor':75C,114C 'hook':111C 'indefinit':123C 'lock':83C 'mediawiki':64C 'miss':70C 'move':119C 'page':84C,100C 'protect':80C,90C,97C 'right':81C 'semant':63C 'set':102C 'templat':107C 'titlequickpermiss':110C 'transclud':106C 'true':98C 'vulner':72C 'wide':105C 'without':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T23:29:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126561","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126561","severity":null,"published_at":"2026-11-11T03:16:50+00:00","modified_at":"2026-11-11T03:16:50+00:00","first_seen_at":"2026-11-11T03:24:59+00:00","fetched_at":"2026-11-11T03:24:59+00:00","note":null}],"documents":[{"id":122022,"url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/ca81329c74aa64077f367e02ad00c079458ef10a","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":122015,"url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.4.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":122024,"url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-9w3p-9m8x-j2mw","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-10T23:29:38+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":122025,"url":"https://www.vulncheck.com/advisories/semantic-mediawiki-2.5.0-before-7.4.1-missing-authorization-via-is-edit-protected-annotation","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}