Vulnerabilities

Vulnerability · CVE-2026-116890

Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks

Published Sep 18, 2026 · catalog updated Oct 28, 2026 · Semantic MediaWiki'a missing authorization

Last checked Oct 28, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-116890. EPSS is 0.19%. Act only if a listed version of Semantic MediaWiki'a missing authorization is installed.

Severity

High7.3

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

0.19%

Remediation

Advisory link

Affected products

Packagist mediawiki/semantic-media-wiki

### Summary The API module performs no authorization check. The equivalent maintenance interface in the web UI ( ) requires the right, but the API module that backs several of the same operations enforces nothing. An unauthenticated visitor can therefore retrieve internal Semantic MediaWiki database statistics and reach state-changing maintenance operations that are intended to be administrator-only. ### Details ( ) reads the request parameters, resolves a task through , and runs it. It contains no permission check — no , no , no per-task right. The only gates on the module are: - — this is **not** authorization. MediaWiki issues anonymous users a fixed, public CSRF token ( ), so any unauthenticated caller satisfies the token check. It defends logged-in users against CSRF; it does nothing against a direct anonymous request. - / — do not gate on group membership. By contrast, restricts access via and raises when the right is absent. The API path bypasses that restriction entirely. Tasks reachable anonymously through the module include: - , — return internal store statistics and enumerate the internal object-ID space (intended to be behind → Supplementary functions). - — enqueues any Semantic MediaWiki job type (including , , ) for an arbitrary title. - , , — run update jobs and queries synchronously within the request; pops and executes queued jobs inline. Because the read tasks disclose the internal object-ID space and can enqueue with a specific parameter, the exposure extends beyond information disclosure and resource consumption to targeted modification of stored semantic data. ### Proof of concept On a default installation, as an unauthenticated visitor: Reproduced on against a default install, with the requester confirmed anonymous ( returned ). ### Impact An unauthenticated attacker can: - Retrieve internal Semantic MediaWiki database statistics — row counts, the last/highest internal object ID, per-namespace breakdowns, and blob term statistics — and enumerat