{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cms-security/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:semantic_mediawiki:semantic_mediawiki:*:*:*:*:*:*:*:*","cpe:2.3:a:semantic-mediawiki:semantic-mediawiki:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-116873"},{"cvss":7.5,"id":"CVE-2026-116878"},{"cvss":7.1,"id":"CVE-2026-116876"},{"cvss":7.3,"id":"CVE-2026-116890"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Semantic MediaWiki (7.3.0 before 7.3.1)","Semantic MediaWiki (\u003e= 2.5.0, \u003c 7.3.1)","Semantic MediaWiki (2.5.0 \u003c= version \u003c 7.3.1)","Semantic MediaWiki (3.0.0-7.2.x)"],"_cs_severities":["high"],"_cs_tags":["denial-of-service","web-application","cve","privilege-escalation","cms-security","vulnerability","authentication-bypass"],"_cs_type":"advisory","_cs_vendors":["Semantic MediaWiki"],"content_html":"\u003cp\u003eSemantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the \u003ccode\u003esmwtask\u003c/code\u003e API module. This allows unauthenticated attackers to use the public anonymous CSRF token with \u003ccode\u003erun-joblist\u003c/code\u003e to execute arbitrary job types in unbounded counts, or invoke \u003ccode\u003eupdate\u003c/code\u003e on sysop-protected pages. These actions can result in the leakage of page titles and resource exhaustion.\u003c/p\u003e\n","date_modified":"2026-10-29T20:13:38Z","date_published":"2026-10-27T11:46:27Z","id":"https://feed.craftedsignal.io/briefs/2026-10-semantic-mediawiki-auth-bypass/","summary":"Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask API module that allows unauthenticated attackers to run queued jobs and force store updates.","title":"Semantic MediaWiki: Missing authorization in smwtask API (CVE-2026-116873)","url":"https://feed.craftedsignal.io/briefs/2026-10-semantic-mediawiki-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cms-Security","version":"https://jsonfeed.org/version/1.1"}