# CVE-2026-116880: Semantic MediaWiki cross-site request forgery in Special:SMWAdmin

Source: https://junglewise.ai/threats/cve-2026-116880-semantic-mediawiki-from-3-0-0-before-7-3-1-contains-a-cross-site  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-116880 · Severity: high · CVSS 7.1 · Published 2026-10-27

Semantic MediaWiki is an extension that adds structured data management to MediaWiki-based wikis. A cross-site request forgery flaw in its administration panel allows an attacker to trick an authenticated admin into triggering destructive maintenance actions—such as schema setup, entity deletion, or job manipulation—simply by visiting a malicious webpage, without the admin's knowledge or consent. This can result in permanent data loss, schema corruption, and system resource exhaustion.

Technologies: [Semantic MediaWiki](https://junglewise.ai/threats/technologies/semantic-mediawiki). Vendors: [Semantic MediaWiki](https://junglewise.ai/threats/vendors/semantic-mediawiki).

## Quick answers

**Is CVE-2026-116880 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116880 being exploited in the wild.

**How severe is CVE-2026-116880?** High severity, with a CVSS score of 7.1, published 27 October 2026.

**Which products and versions are affected?** Semantic MediaWiki 3.0.0 through 7.3.0.

**Is there a fix for CVE-2026-116880?** Yes: fixed in 7.3.1. Until then: Require POST for all state-changing maintenance actions and validate matchEditToken() before performing operations in a centralized dispatcher or in each handler.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-09-28","note":"GitHub Security Advisory GHSA-7f7v-2qf4-gfq3 published"},{"kind":"advisory","at":"2026-10-27"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116880 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-116880?** Check whether you run Semantic MediaWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 7.3.1

Require POST for all state-changing maintenance actions and validate matchEditToken() before performing operations in a centralized dispatcher or in each handler.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-09-28","note":"GitHub Security Advisory GHSA-7f7v-2qf4-gfq3 published"},{"kind":"advisory","at":"2026-10-27"}]

## Technical details

The vulnerability exists in Special:SMWAdmin where SpecialAdmin::execute() replaces the request's wpEditToken with a freshly generated valid token before dispatching maintenance actions, bypassing token validation. Some handlers like TableSchemaTaskHandler do not enforce POST or validate tokens themselves, allowing an unauthenticated attacker to craft a request that performs state-changing operations when visited by an authenticated smw-admin user. The attack requires the victim to be logged in with admin privileges and the maintenance feature to be enabled.

## Affected products

- Semantic MediaWiki Semantic MediaWiki 3.0.0 through 7.3.0

## References

- [https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-7f7v-2qf4-gfq3](https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-7f7v-2qf4-gfq3)
- [https://www.vulncheck.com/advisories/semantic-mediawiki-3.0.0-before-7.3.1-csrf-via-special-smwadmin-maintenance-actions](https://www.vulncheck.com/advisories/semantic-mediawiki-3.0.0-before-7.3.1-csrf-via-special-smwadmin-maintenance-actions)

## Related threats

- [Semantic MediaWiki authorization bypass in edit protection](https://junglewise.ai/threats/cve-2026-126566-semantic-mediawiki-7-3-1-before-7-4-1-contains-an-incorrect)
- [Semantic MediaWiki denial of service in concept expansion](https://junglewise.ai/threats/cve-2026-126565-semantic-mediawiki-3-0-0-before-7-4-1-contains-a-denial-of)
- [Semantic MediaWiki stored XSS in ValueFormatter property label](https://junglewise.ai/threats/cve-2026-126564-semantic-mediawiki-2-5-0-before-7-4-1-contains-a-stored-cross)
- [Semantic MediaWiki uncontrolled recursion in ConceptDescriptionInterpreter](https://junglewise.ai/threats/cve-2026-126562-semantic-mediawiki-3-0-0-before-7-4-1-contains-an-uncontrolled)
- [Semantic MediaWiki missing authorization in page edit protection](https://junglewise.ai/threats/cve-2026-126561-semantic-mediawiki-2-5-0-before-7-4-1-contains-a-missing)