{"id":"CVE-2026-126566","kind":"vulnerability","aliases":["CVE-2026-126566"],"related":[],"title":"Semantic MediaWiki: editors can remove admin page protection via templates","description":"Semantic MediaWiki 7.3.1 before 7.4.1 contains an incorrect authorization vulnerability in EditProtectionUpdater::userMayChangeProtection() that checks protection changes against the page's latest revision author. Editors can add {{#set:Is edit protected=false}} to a transcluded template, removing administrator edit and move protection logged under the administrator's name.","summary":"Semantic MediaWiki's protection update logic checks changes against the page's latest revision author instead of the actual user. An editor can add a #set call in a transcluded template to clear edit and move protection that an administrator set, with the change logged under the administrator's name.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mediawiki","package","self-hosted","semantic-mediawiki","wiki"],"not_affected_if":["semantic-mediawiki-not-installed","version-outside-range"],"how_to_check":"- Check the installed Semantic MediaWiki version in the wiki's Special:Version page or `composer show mediawiki/semantic-media-wiki`\n- Confirm whether the wiki uses the EditProtectionUpdater code path with protected pages (unknown from sources beyond the affected range)","fix":"- Semantic MediaWiki `7.4.1` or later (the affected range is 7.3.1 before 7.4.1)","status":"open","published_at":"2026-11-11T03:16:51+00:00","first_seen_at":"2026-11-11T03:25:00+00:00","triaged_at":"2026-11-11T03:26:21+00:00","updated_at":"2026-11-11T03:26:21+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T03:26:21Z","model":"claude-haiku-5-5","output":{"fix":"- Semantic MediaWiki `7.4.1` or later (the affected range is 7.3.1 before 7.4.1)","reach":"network","title":"Semantic MediaWiki: editors can remove admin page protection via templates","impact":"medium","summary":"Semantic MediaWiki's protection update logic checks changes against the page's latest revision author instead of the actual user. An editor can add a #set call in a transcluded template to clear edit and move protection that an administrator set, with the change logged under the administrator's name.","audience":"businesses","category":"package","nicknames":[],"who_cares":["mediawiki","semantic-mediawiki","self-hosted","wiki"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Editors remove administrator page protection and hide the change under admin name","analyst_note":"unknown","how_to_check":"- Check the installed Semantic MediaWiki version in the wiki's Special:Version page or `composer show mediawiki/semantic-media-wiki`\n- Confirm whether the wiki uses the EditProtectionUpdater code path with protected pages (unknown from sources beyond the affected range)","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-outside-range","semantic-mediawiki-not-installed"],"who_is_affected":"Wikis running Semantic MediaWiki 7.3.1 up to but not including 7.4.1 are affected. The exposure involves editors who can edit templates on pages that use protection, so wikis with open editing or many editors carry more risk. Wikis on other versions, or without Semantic MediaWiki installed, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000767,"input_tokens":4651,"output_tokens":604,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126566':13A,16A '-2026':12A,15A '7.3.1':78C '7.4.1':80C 'actual':44B 'add':49B,102C 'admin':6A 'administr':65B,73B,113C,121C 'author':40B,84C,99C 'call':52B 'chang':33B,69B,92C 'check':32B,90C 'clear':58B 'contain':81C 'cve':11A,14A 'edit':59B,105C,114C 'editor':3A,47B,100C 'editprotectionupdat':87C 'fals':107C 'host':21B 'incorrect':83C 'instead':41B 'latest':38B,97C 'log':70B,118C 'logic':31B 'mediawiki':2A,17B,24B,27B,77C 'move':61B,116C 'name':75B,123C 'packag':18B 'page':7A,36B,95C 'protect':8A,29B,62B,91C,106C,117C 'remov':5A,112C 'revis':39B,98C 'self':20B 'self-host':19B 'semant':1A,23B,26B,76C 'semantic-mediawiki':22B 'set':51B,66B,103C 'templat':10A,56B,111C 'transclud':55B,110C 'updat':30B 'user':45B 'usermaychangeprotect':88C 'via':9A 'vulner':85C 'wiki':25B","nicknames":[],"mitigations":[],"who_affected":"Wikis running Semantic MediaWiki 7.3.1 up to but not including 7.4.1 are affected. The exposure involves editors who can edit templates on pages that use protection, so wikis with open editing or many editors carry more risk. Wikis on other versions, or without Semantic MediaWiki installed, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","mediawiki","package","selfhosted","semanticmediawiki","wiki"],"campaign_type":null,"search_a":"'-126566':13A,16A '-2026':12A,15A 'admin':6A 'cve':11A,14A 'editor':3A 'mediawiki':2A 'page':7A 'protect':8A 'remov':5A 'semant':1A 'templat':10A 'via':9A","search_b":"'actual':44B 'add':49B 'administr':65B,73B 'author':40B 'call':52B 'chang':33B,69B 'check':32B 'clear':58B 'edit':59B 'editor':47B 'host':21B 'instead':41B 'latest':38B 'log':70B 'logic':31B 'mediawiki':17B,24B,27B 'move':61B 'name':75B 'packag':18B 'page':36B 'protect':29B,62B 'revis':39B 'self':20B 'self-host':19B 'semant':23B,26B 'semantic-mediawiki':22B 'set':51B,66B 'templat':56B 'transclud':55B 'updat':30B 'user':45B 'wiki':25B","search_c":"'7.3.1':78C '7.4.1':80C 'add':102C 'administr':113C,121C 'author':84C,99C 'chang':92C 'check':90C 'contain':81C 'edit':105C,114C 'editor':100C 'editprotectionupdat':87C 'fals':107C 'incorrect':83C 'latest':97C 'log':118C 'mediawiki':77C 'move':116C 'name':123C 'page':95C 'protect':91C,106C,117C 'remov':112C 'revis':98C 'semant':76C 'set':103C 'templat':111C 'transclud':110C 'usermaychangeprotect':88C 'vulner':85C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T23:29:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126566","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126566","severity":null,"published_at":"2026-11-11T03:16:51+00:00","modified_at":"2026-11-11T03:16:51+00:00","first_seen_at":"2026-11-11T03:25:00+00:00","fetched_at":"2026-11-11T03:25:00+00:00","note":null}],"documents":[{"id":122045,"url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/32ca6d8fc75735aa7a2ecc573886391da126da9b","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":122015,"url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.4.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":122047,"url":"https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-gh59-2vh3-6cgm","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-10T23:29:39+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":122048,"url":"https://www.vulncheck.com/advisories/semantic-mediawiki-7.3.1-before-7.4.1-incorrect-authorization-via-edit-protection-annotations","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}