Quick answers
- Is CVE-2026-116879 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-116879 being exploited in the wild.
- How severe is CVE-2026-116879?
- Medium severity, with a CVSS score of 5.4, published 27 October 2026.
- Which products and versions are affected?
- Semantic MediaWiki 7.3.0 before 7.3.1.
- Is there a fix for CVE-2026-116879?
- Yes: fixed in 7.3.1. Until then: Restrict the smwtask API endpoint at the web server or wiki configuration level to users with higher privileges (such as smw-admin), or disable the update and run-joblist tasks if not required for normal operations. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-116879 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-116879?
- Check whether you run Semantic MediaWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 7.3.1
Restrict the smwtask API endpoint at the web server or wiki configuration level to users with higher privileges (such as smw-admin), or disable the update and run-joblist tasks if not required for normal operations.
Technical details
The update task in smwtask's API endpoint accepts a caller-supplied serialized subject parameter and deserializes it to trigger forced semantic updates without verifying the caller can edit the target page. The vulnerability stems from checking only the global edit right rather than title-level authorization, allowing an authenticated editor to invoke UpdateJob::FORCED_UPDATE on arbitrary protected pages through the smwtask API.
Affected products
- Semantic MediaWiki Semantic MediaWiki 7.3.0 before 7.3.1
Timeline
- 2026-09-28: disclosed
- 2026-10-27: advisory
- 2026-09-28: patched: Fix committed to repository