CVE-2026-116876 in Semantic MediaWiki
Summary
by MITRE • 10/27/2026
Semantic MediaWiki from 2.5.0 before 7.3.1 contains an improper authorization vulnerability that allows ordinary editors to permanently protect pages by adding an Is edit protected annotation. When $smwgEditProtectionRight is enabled, EditProtectionUpdater applies indefinite edit and move restrictions without checking the author's rights, locking other editors and administrators out.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The identified security flaw resides within Semantic MediaWiki versions ranging from 2.5.0 up to but not including version 7.3.1, representing a critical failure in access control mechanisms that undermines the integrity of content management workflows. This vulnerability is classified as an improper authorization issue where the application fails to correctly verify user privileges before executing administrative actions. Specifically, the defect allows users with only standard editing permissions to bypass intended restrictions and apply permanent protection status to wiki pages by injecting or modifying a specific annotation known as Is edit protected. In typical MediaWiki environments, page protection is a privileged operation reserved for administrators or users with explicit sysop rights, ensuring that content stability is maintained through proper oversight rather than arbitrary user action.
The technical root cause lies in the EditProtectionUpdater component which processes these annotations without adequately validating whether the initiating request originates from an authorized entity. When the configuration variable $smwgEditProtectionRight is enabled, the system erroneously trusts the input data associated with this annotation to dictate protection levels. Consequently, any ordinary editor can trigger a state change that applies indefinite restrictions on both editing and moving pages. This logic error effectively grants low-privilege users administrative capabilities regarding page lifecycle management, creating a significant disparity between intended security policies and actual runtime behavior. The absence of a secondary verification step for user roles during the processing of this specific semantic annotation is what enables the exploitation path to succeed without detection by standard access control lists.
The operational impact of this vulnerability is severe as it allows malicious or compromised low-level accounts to perform denial-of-service attacks against content availability and integrity. By permanently protecting pages, attackers can lock out legitimate contributors including administrators who may not have immediate awareness of the change until they attempt to modify critical documentation or data structures. This effectively paralyzes collaborative editing processes and can be used to deface wiki content by preventing corrections or updates. Furthermore, this abuse of privilege escalation capabilities disrupts business continuity for organizations relying on Semantic MediaWiki as a knowledge base or internal documentation system, requiring manual intervention from higher-level administrators to reverse the unauthorized protection states.
From an industry standards perspective, this vulnerability aligns with CWE-269 which denotes Improper Privilege Management, specifically highlighting failures in enforcing role-based access controls during critical operations. It also maps to MITRE ATT&CK techniques related to Defense Evasion and Impact, where adversaries manipulate system configurations to hinder detection or disrupt availability. To mitigate this risk, administrators must immediately upgrade Semantic MediaWiki to version 7.3.1 or later where the authorization checks have been corrected to validate user permissions before applying protection annotations. Additionally, until an upgrade is feasible, it is advisable to disable the $smwgEditProtectionRight configuration option if not strictly necessary for specific workflows, thereby removing the attack vector that allows unprivileged users to trigger administrative state changes through semantic data injection.