PT-2026-126351

CVE-2026-116890

·

Published

2026-10-27

·

Updated

2026-10-27

Description by

CVSS 3.1
7.3
High
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics, enqueue jobs like smw.entityIdDisposer, and execute queued jobs, degrading performance and altering semantic data.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-862: Missing Authorization
Related identifiers
CVE-2026-116890
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com