Executive brief
Semantic MediaWiki's smwtask API endpoint fails to enforce permission checks, allowing unauthenticated users to access administrator-only database operations. An attacker can retrieve internal database statistics, trigger resource-intensive maintenance jobs, and modify semantic data—capabilities normally restricted to administrators via the web interface.
Technical details
The vulnerability is a missing authorization check in SMW\MediaWiki\Api\Task::execute() (src/MediaWiki/Api/Task.php). The module relies solely on CSRF token validation (`needsToken('csrf')`), which does not authorize; MediaWiki issues anonymous users a fixed, public CSRF token ("+\"), allowing unauthenticated requests to pass. The corresponding web interface (Special:SMWAdmin) correctly enforces the 'smw-admin' right via permission checks and PermissionsError exceptions. Unauthenticated attackers can invoke tasks including table-statistics (information disclosure), insert-job (resource exhaustion via arbitrary job enqueue), and run-joblist (synchronous execution of maintenance operations), and can target semantic data integrity via entity-disposal operations.
Affected products
- Semantic MediaWiki Semantic MediaWiki 3.0 through 7.2.x (all versions with smwtask API module)
Timeline
- 2026-09-18: disclosed