Semantic MediaWiki: Missing authorization vulnerability (CVE-2026-126561)

Semantic MediaWiki versions prior to 7.4.1 are vulnerable to a missing authorization flaw. Users who lack the 'edit-protection' right can apply the 'Is edit protected' annotation to wiki pages. When this annotation is added directly to a page or included via widely transcluded templates, the TitleQuickPermissions hook is triggered. This action effectively locks the affected pages, preventing any further edits, moves, or deletions by other users, including administrators.

Impact

Successful exploitation results in unauthorized permanent denial of service for specific pages or templates. The impact is significant because the lock persists indefinitely and affects administrative accounts, potentially disrupting site operations and collaborative workflows.

Recommendation

• Upgrade Semantic MediaWiki to version 7.4.1 or later to remediate the vulnerability.
• Review existing wiki content and templates for the presence of '[[Is edit protected::true]]' annotations added by non-authorized users.
• Implement monitoring for modifications to sensitive templates or frequently accessed pages to detect unauthorized use of the 'Is edit protected' annotation.