{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/semantic-mediawiki--7.4.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:semantic_mediawiki:semantic_mediawiki:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-126561"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Semantic MediaWiki (\u003c 7.4.1)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Semantic MediaWiki"],"content_html":"\u003cp\u003eSemantic MediaWiki versions prior to 7.4.1 are vulnerable to a missing authorization flaw. Users who lack the 'edit-protection' right can apply the 'Is edit protected' annotation to wiki pages. When this annotation is added directly to a page or included via widely transcluded templates, the TitleQuickPermissions hook is triggered. This action effectively locks the affected pages, preventing any further edits, moves, or deletions by other users, including administrators.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in unauthorized permanent denial of service for specific pages or templates. The impact is significant because the lock persists indefinitely and affects administrative accounts, potentially disrupting site operations and collaborative workflows.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Semantic MediaWiki to version 7.4.1 or later to remediate the vulnerability.\u003c/li\u003e\n\u003cli\u003eReview existing wiki content and templates for the presence of '[[Is edit protected::true]]' annotations added by non-authorized users.\u003c/li\u003e\n\u003cli\u003eImplement monitoring for modifications to sensitive templates or frequently accessed pages to detect unauthorized use of the 'Is edit protected' annotation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T13:53:47Z","date_published":"2026-11-11T13:53:47Z","id":"https://feed.craftedsignal.io/briefs/2026-11-semantic-mediawiki-auth-bypass-cve-2026-126561/","summary":"Semantic MediaWiki versions prior to 7.4.1 contain a missing authorization vulnerability allowing unauthorized users to lock pages indefinitely via malicious annotations.","title":"Semantic MediaWiki: Missing authorization vulnerability (CVE-2026-126561)","url":"https://feed.craftedsignal.io/briefs/2026-11-semantic-mediawiki-auth-bypass-cve-2026-126561/"}],"language":"en","title":"CraftedSignal Threat Feed - Semantic MediaWiki (\u003c 7.4.1)","version":"https://jsonfeed.org/version/1.1"}