CVE-2026-126566 · Package
NO FIX YET · SEE WHAT TO DO
Semantic MediaWiki's protection update logic checks changes against the page's latest revision author instead of the actual user. An editor can add a #set call in a transcluded template to clear edit and move protection that an administrator set, with the change logged under the administrator's name.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Wikis running Semantic MediaWiki 7.3.1 up to but not including 7.4.1 are affected. The exposure involves editors who can edit templates on pages that use protection, so wikis with open editing or many editors carry more risk. Wikis on other versions, or without Semantic MediaWiki installed, can skip it.
Not affected if semantic-mediawiki-not-installed, version-outside-range
Who cares mediawiki, self-hosted, semantic-mediawiki, wiki
composer show mediawiki/semantic-media-wiki7.4.1 or later (the affected range is 7.3.1 before 7.4.1)Semantic MediaWiki 7.3.1 before 7.4.1 contains an incorrect authorization vulnerability in EditProtectionUpdater::userMayChangeProtection() that checks protection changes against the page's latest revision author. Editors can add {{#set:Is edit protected=false}} to a transcluded template, removing administrator edit and move protection logged under the administrator's name.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.