Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-116873

Semantic MediaWiki 7.3.0 Missing Authorization via smwtask API run-joblist and update

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask API module that allows unauthenticated attackers to run queued jobs and force store updates. Attackers can use the public anonymous CSRF token with run-joblist to execute arbitrary job types in unbounded counts, or invoke update on sysop-protected pages, leaking page titles and exhausting resources.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SemanticMediaWiki SemanticMediaWiki

Default version status: unaffected

  • 7.3.0 to < 7.3.1affected
  • 7.3.1unaffected

References