CVE-2026-116876
Received Received - Intake

Improper Authorization in Semantic MediaWiki Leading to Indefinite Page Protection

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: VulnCheck

Description
Semantic MediaWiki from 2.5.0 before 7.3.1 contains an improper authorization vulnerability that allows ordinary editors to permanently protect pages by adding an Is edit protected annotation. When $smwgEditProtectionRight is enabled, EditProtectionUpdater applies indefinite edit and move restrictions without checking the author's rights, locking other editors and administrators out.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-27
AI Q&A
2026-10-27
EPSS Evaluated
N/A
NVD
CVE-2026-116876
EUVD
EUVD-2026-110704

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
SemanticMediaWiki SemanticMediaWiki 2.5.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Semantic MediaWiki allows ordinary editors to permanently protect pages by adding an Is edit protected annotation without proper authorization. When the edit-protection feature is enabled, the EditProtectionUpdater applies indefinite restrictions without checking user rights, locking others out.

Detection Guidance

Check Semantic MediaWiki versions between 2.5.0 and 7.3.1 for the presence of the [[Is edit protected::true]] annotation on pages. Review recent changes to see if unauthorized users added this annotation without proper rights.

Impact Analysis

Attackers can lock other editors and administrators out of pages by applying indefinite edit and move restrictions. This disrupts collaborative editing and may lead to unauthorized content protection, causing availability issues for the wiki.

Mitigation Strategies

Upgrade Semantic MediaWiki to version 7.3.1 or later to apply the authorization check fix. If upgrading is not possible, disable the $smwgEditProtectionRight feature in configuration to prevent annotation-based protection.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116876. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart