# CVE-2026-116890: Semantic MediaWiki missing authorization in smwtask API

Source: https://junglewise.ai/threats/cve-2026-116890-semantic-mediawiki-from-3-0-0-before-7-3-0-contains-a-missing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-116890 · Severity: high · CVSS 7.3 · Published 2026-10-27

Semantic MediaWiki is an extension for MediaWiki that adds semantic database and querying capabilities. The smwtask API module fails to check user permissions, allowing unauthenticated attackers to retrieve internal database statistics, enqueue maintenance jobs, and modify semantic data—operations that should be restricted to administrators. This could degrade wiki performance and corrupt data stored in the semantic database.

Technologies: [SemanticMediaWiki Semantic MediaWiki](https://junglewise.ai/threats/technologies/semanticmediawiki-semantic-mediawiki). Vendors: [SemanticMediaWiki](https://junglewise.ai/threats/vendors/semanticmediawiki).

## Quick answers

**Is CVE-2026-116890 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116890 being exploited in the wild.

**How severe is CVE-2026-116890?** High severity, with a CVSS score of 7.3, published 27 October 2026.

**Which products and versions are affected?** SemanticMediaWiki Semantic MediaWiki 3.0.0 to 7.2.1.

**Is there a fix for CVE-2026-116890?** Yes: fixed in 7.3.0. Until then: If unable to upgrade, disable the endpoint in localSettings.php by adding: wgExtensionFunctions[] = static function () { unset( $GLOBALS['wgAPIModules']['smwtask'] ); }; Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116890 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-116890?** Check whether you run SemanticMediaWiki Semantic MediaWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 7.3.0

If unable to upgrade, disable the endpoint in localSettings.php by adding: wgExtensionFunctions[] = static function () { unset( $GLOBALS['wgAPIModules']['smwtask'] ); };

## Technical details

The SMW\MediaWiki\Api\Task::execute() method in api.php performs no authorization checks despite backing admin-only maintenance operations. While the method enforces a CSRF token check and write-mode requirements, the anonymous CSRF token (+\) is publicly known and fixed for all unauthenticated users, effectively providing no protection. Attackers can invoke tasks like table-statistics (information disclosure), insert-job (enqueue arbitrary jobs), and run-joblist (execute synchronously) via direct API calls, with the integrity impact extending to targeted entity disposal via smw.entityIdDisposer.

## Affected products

- SemanticMediaWiki Semantic MediaWiki 3.0.0 to 7.2.1

## Timeline

- 2026-09-16: disclosed: GitHub security advisory published
- 2026-10-27: advisory: Public advisory published on NVD

## References

- [https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-jr78-w6w5-m8f8](https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-jr78-w6w5-m8f8)
- [https://www.vulncheck.com/advisories/semantic-mediawiki-3.0.0-before-7.3.0-missing-authorization-via-smwtask-api](https://www.vulncheck.com/advisories/semantic-mediawiki-3.0.0-before-7.3.0-missing-authorization-via-smwtask-api)

## Related threats

- [Semantic MediaWiki stored XSS in Special:Ask with ElasticStore](https://junglewise.ai/threats/cve-2026-126567-semantic-mediawiki-3-0-0-before-7-4-1-contains-a-stored-cross)
- [Semantic MediaWiki reflected XSS in TimeValueFormatter](https://junglewise.ai/threats/cve-2026-126563-semantic-mediawiki-2-4-0-before-7-4-1-contains-a-reflected-cross)
- [Semantic MediaWiki uncontrolled recursion in query parser](https://junglewise.ai/threats/cve-2026-116871-semantic-mediawiki-3-0-0-before-7-3-1-contains-an-uncontrolled)