7.3
HighCVSS 3.1 · from VulnCheck
CVE-2026-116890
Semantic MediaWiki 3.0.0 before 7.3.0 Missing Authorization via smwtask API
SemanticMediaWiki · Missing authorization · CWE-862AffectedSemanticMediaWiki
FixUpdate to 7.3.0 or newer
PublishedOct 27, 10:23 · VulnCheck
ScoredOct 27 · 7.3 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:09 UTC
What we know
No known exploitation. CISA KEV, checked 22:09 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
Description
Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics, enqueue jobs like smw.entityIdDisposer, and execute queued jobs, degrading performance and altering semantic data.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed inSemanticMediaWiki3.0.0 – before 7.3.07.3.0SemanticMediaWikiNot affected7.3.0
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known