Skip to content
Threat Feed
Subscribe
medium advisory

Semantic MediaWiki: Missing authorization in smwtask API (CVE-2026-116873)

Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask API module that allows unauthenticated attackers to run queued jobs and force store updates.

CVE search metadata

CVE search record: CVE-2026-116873. Severity: high. CVSS: 7.3. KEV: no. Product: Semantic MediaWiki (7.3.0 before 7.3.1), Semantic MediaWiki (>= 2.5.0, < 7.3.1). Brief: Semantic MediaWiki: Missing authorization in smwtask API (CVE-2026-116873). Brief link: https://feed.craftedsignal.io/briefs/2026-10-semantic-mediawiki-auth-bypass/

CVE search record: CVE-2026-116878. Severity: high. CVSS: 7.5. KEV: no. Product: Semantic MediaWiki (7.3.0 before 7.3.1), Semantic MediaWiki (>= 2.5.0, < 7.3.1). Brief: Semantic MediaWiki: Missing authorization in smwtask API (CVE-2026-116873). Brief link: https://feed.craftedsignal.io/briefs/2026-10-semantic-mediawiki-auth-bypass/

Triage facts

Revision 1
Applicability
Semantic MediaWiki (7.3.0 before 7.3.1), Semantic MediaWiki (>= 2.5.0, < 7.3.1)
Evidence
Unknown
Severity
Medium
Action
Elevated
Sources
2 public sources
Freshness
Revision 1Oct 27, 11:46 UTC
Detection
1 rule
Vulnerabilities
2 CVEs
Source quality
A2Roughly even chance

What's new

  • 1. added detection rule: Detects CVE-2026-116878 Exploitation - Resource Exhaustion via PropertyLabelSimilarity Oct 27, 11:46 via nvd

Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask API module. This allows unauthenticated attackers to use the public anonymous CSRF token with run-joblist to execute arbitrary job types in unbounded counts, or invoke update on sysop-protected pages. These actions can result in the leakage of page titles and resource exhaustion.

Immediate actions

Patch Semantic MediaWiki to version 7.3.1

IT Operations 48h

Mitigations

Block or rate-limit requests to 'Special:PropertyLabelSimilarity' with 'limit=0'

immediate SOC

CVE-2026-116878

Detection coverage 1

Detects CVE-2026-116878 Exploitation - Resource Exhaustion via PropertyLabelSimilarity

high

Detects attempts to trigger resource exhaustion in Semantic MediaWiki by targeting the Special:PropertyLabelSimilarity endpoint with a limit parameter of zero.

sigma tactics: impact techniques: T1499 sources: webserver

Detection queries are available on the platform. Get full rules →