SemanticMediaWiki Semantic MediaWiki up to 7.4.0 TitleQuickPermissions Hook improper authorization

Summaryinfo

A vulnerability was found in SemanticMediaWiki Semantic MediaWiki up to 7.4.0. It has been classified as problematic. The affected element is an unknown function of the component TitleQuickPermissions Hook. Performing a manipulation results in improper authorization. This vulnerability was named CVE-2026-126561. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic has been found in SemanticMediaWiki Semantic MediaWiki up to 7.4.0. This affects an unknown code block of the component TitleQuickPermissions Hook. The manipulation with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on integrity, and availability. The summary by CVE is:

Semantic MediaWiki 2.5.0 before 7.4.1 contains a missing authorization vulnerability that allows editors without the edit-protection right to lock pages by adding an Is edit protected annotation. Attackers can add [[Is edit protected::true]] to pages or #set it in widely transcluded templates, so the TitleQuickPermissions hook blocks other editors and administrators from editing, moving or deleting them indefinitely.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-126561 since 11/11/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1548.002 for this issue.

Upgrading to version 7.4.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-123076). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Content Management System

Vendor

• SemanticMediaWiki

Name

• Semantic MediaWiki

Version

• 7.0
• 7.1
• 7.2
• 7.3
• 7.4.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion