CVE-2026-116890 Semantic MediaWiki 3.0.0 before 7.3.0 Missing Authorization via smwtask API
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-116890?
CVE-2026-116890 is a medium-severity vulnerability in SemanticMediaWiki, published on 27 Oct 2026.
Official description
Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics, enqueue jobs like smw.entityIdDisposer, and execute queued jobs, degrading performance and altering semantic data.
Weakness: CWE-862
Which versions are affected by CVE-2026-116890?
2 open source packages ship an affected version, including mediawiki/semantic-media-wiki.
| Package | Affected | Fixed in |
|---|---|---|
mediawiki/semantic-media-wiki Packagist | From 3.0.0 | 7.3.0 |
mediawiki/semantic-media-wiki Packagist | From 3.0.0 | 7.3.0 |
How do I fix CVE-2026-116890?
Upgrade mediawiki/semantic-media-wiki to 7.3.0 or later.
Is CVE-2026-116890 being exploited?
There is no known exploitation of CVE-2026-116890 in the wild and no public exploit code.
Sources
Also known as GHSA-4cv4-rp7r-qh6c, GHSA-jr78-w6w5-m8f8.