CVE-2026-116890
Received Received - Intake

Unauthenticated Admin Task Execution in Semantic MediaWiki

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: VulnCheck

Description
Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics, enqueue jobs like smw.entityIdDisposer, and execute queued jobs, degrading performance and altering semantic data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-27
AI Q&A
2026-10-27
EPSS Evaluated
N/A
NVD
CVE-2026-116890
EUVD
EUVD-2026-110718

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
SemanticMediaWiki SemanticMediaWiki 3.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Semantic MediaWiki versions 3.0.0 to 7.2.1. It is a missing authorization flaw in the smwtask API module (api.php) that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers exploit a public anonymous CSRF token to bypass permission checks and execute tasks like reading internal statistics or enqueuing jobs that degrade performance or alter data.

Detection Guidance

Check Semantic MediaWiki versions between 3.0.0 and 7.2.1 by inspecting the version in LocalSettings.php or via the API. Monitor for unusual API calls to api.php?action=smwtask or unexpected job enqueues like smw.entityIdDisposer. Review server logs for high-frequency requests to these endpoints.

Impact Analysis

Unauthenticated attackers can read internal store statistics, enqueue resource-intensive jobs (e.g., smw.entityIdDisposer), and trigger queued jobs. This can degrade system performance, cause service disruption, and potentially modify semantic data integrity. The impact includes unauthorized data access, performance degradation, and possible data corruption.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Unauthorized changes to semantic data may result in non-compliance with these regulations, potentially leading to legal and financial penalties.

Mitigation Strategies

Upgrade Semantic MediaWiki to version 7.3.0 or later. Alternatively, disable the smwtask API module by applying a local patch or restricting access to api.php. Ensure no unauthorized jobs are queued and review existing jobs for signs of compromise.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116890. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart