CVE-2026-116876 Semantic MediaWiki 2.5.0 before 7.3.1 Missing Authorization via Is edit protected

High 7.1 Published 27 Oct 2026 Updated 27 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-116876?

CVE-2026-116876 is a high-severity vulnerability in SemanticMediaWiki, published on 27 Oct 2026.

Official description

Semantic MediaWiki from 2.5.0 before 7.3.1 contains an improper authorization vulnerability that allows ordinary editors to permanently protect pages by adding an Is edit protected annotation. When $smwgEditProtectionRight is enabled, EditProtectionUpdater applies indefinite edit and move restrictions without checking the author's rights, locking other editors and administrators out.

Weakness: CWE-862

Which versions are affected by CVE-2026-116876?

How do I fix CVE-2026-116876?

No fix has been published for CVE-2026-116876 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-116876 being exploited?

There is no known exploitation of CVE-2026-116876 in the wild and no public exploit code.

Sources

Also known as GHSA-9824-67pm-c29j, GHSA-p662-q5fq-6fm5.