CVE-2026-116890 in Semantic MediaWiki
Summary
by MITRE • 10/27/2026
Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics, enqueue jobs like smw.entityIdDisposer, and execute queued jobs, degrading performance and altering semantic data.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in Semantic MediaWiki versions ranging from 3.0.0 up to but not including version 7.3.0 represents a critical failure in access control mechanisms within the application's API layer. Specifically, this flaw resides in the smwtask module of api.php, which is designed to handle maintenance tasks that typically require elevated privileges or administrative rights. The core technical issue stems from missing authorization checks that allow unauthenticated users to interact with endpoints intended exclusively for administrators. This misconfiguration effectively bypasses the security boundary between public-facing operations and internal system management functions, exposing sensitive backend processes to external actors without any form of authentication or valid session validation.
From a technical perspective, the exploitation vector relies on the misuse of anonymous Cross-Site Request Forgery (CSRF) tokens that are publicly accessible within the application's context. Normally, CSRF protections are designed to prevent unauthorized commands from being submitted by an authenticated user whose browser is tricked into making requests; however, in this scenario, these tokens are available without prior authentication for specific API endpoints. An attacker can leverage these anonymous tokens to construct malicious requests that invoke administrative maintenance routines. By doing so, the attacker gains the ability to read internal store statistics, which may reveal sensitive information about the wiki's structure and data volume, and manipulate job queues managed by the MediaWiki infrastructure.
The operational impact of this vulnerability is significant due to its potential for both informational disclosure and service disruption. Attackers can enqueue specific maintenance jobs such as smw.entityIdDisposer, a process responsible for cleaning up entity identifiers within Semantic MediaWiki's internal store. While seemingly routine, forcing these tasks through unauthenticated channels allows an attacker to trigger resource-intensive operations at will. This capability leads directly to performance degradation, as the server must allocate CPU and memory resources to execute these maintenance jobs repeatedly or in large volumes. Furthermore, because these jobs interact with the semantic data layer, improper execution can lead to alterations or corruption of stored semantic relationships, potentially compromising the integrity of the wiki's knowledge base and rendering structured data unreliable for downstream applications that depend on it.
This vulnerability aligns closely with CWE-284, which describes Improper Access Control, as well as CWE-913, concerning improper control of dynamically managed code resources if the job queue manipulation leads to resource exhaustion. In terms of offensive security frameworks, this behavior maps to MITRE ATT&CK technique T1059, specifically Command and Scripting Interpreter subcategories where attackers use system utilities or scripts for maintenance tasks that are not intended for public consumption. The ability to execute queued jobs also touches upon aspects of service availability attacks, similar to denial-of-service vectors found in CWE-400, although the primary intent here is often data manipulation rather than pure resource exhaustion.
To mitigate this risk, administrators must immediately upgrade Semantic MediaWiki to version 7.3.0 or later, where these authorization checks have been properly implemented and enforced within the api.php module. Until an upgrade is feasible, temporary mitigations should include restricting access to the API endpoint via web server configuration rules if possible, ensuring that only trusted IP addresses can reach the maintenance interfaces. Additionally, reviewing CSRF token generation policies for anonymous users may help reduce exposure, although upgrading remains the definitive solution as it patches the underlying logic flaw in the authorization framework rather than just obscuring the entry point. Regular audits of API endpoints against expected privilege levels are recommended to prevent similar access control failures in future releases.