Semantic MediaWiki: Cross-site request forgery in Special:SMWAdmin (CVE-2026-116880)
Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Special:SMWAdmin, allowing an attacker to trigger unauthorized administrative actions.
CVE search metadata
CVE search record: CVE-2026-116880. Severity: high. CVSS: 7.1. KEV: no. Product: Semantic MediaWiki (3.0.0 before 7.3.1). Brief: Semantic MediaWiki: Cross-site request forgery in Special:SMWAdmin (CVE-2026-116880). Brief link: https://feed.craftedsignal.io/briefs/2026-10-semantic-mediawiki-csrf/
Triage facts
Revision 1- Applicability
- Semantic MediaWiki (3.0.0 before 7.3.1)
- Evidence
- Not observed
- Severity
- Medium
- Sources
- 1 public source
- Freshness
- Revision 1Oct 27, 11:46 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery (CSRF) vulnerability in Special:SMWAdmin. The vulnerability occurs because the application overwrites the wpEditToken with a freshly generated valid token. An attacker can lure an authenticated smw-admin user to a malicious page that triggers schema setup, entity-disposal, or job actions, potentially resulting in semantic data loss and resource exhaustion.