Semantic MediaWiki missing authorization in smwtask API module

Severity: high · CVSS 7.3 · Published 2026-09-18

Semantic MediaWiki's smwtask API endpoint fails to enforce permission checks, allowing unauthenticated users to access administrator-only database operations. An attacker can retrieve internal database statistics, trigger resource-intensive maintenance jobs, and modify semantic data—capabilities normally restricted to administrators via the web interface.

Technologies: mediawiki/semantic-media-wiki (Packagist), Semantic MediaWiki. Vendors: Packagist, Semantic MediaWiki.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
High severity, with a CVSS score of 7.3, published 18 September 2026.
Which products and versions are affected?
mediawiki/semantic-media-wiki (Packagist) >= 3.0.0, <= 7.2.1; Semantic MediaWiki 3.0 through 7.2.x (all versions with smwtask API module).
Is there a fix for This vulnerability?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run mediawiki/semantic-media-wiki (Packagist) or Semantic MediaWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing authorization check in SMW\MediaWiki\Api\Task::execute() (src/MediaWiki/Api/Task.php). The module relies solely on CSRF token validation (`needsToken('csrf')`), which does not authorize; MediaWiki issues anonymous users a fixed, public CSRF token ("+\"), allowing unauthenticated requests to pass. The corresponding web interface (Special:SMWAdmin) correctly enforces the 'smw-admin' right via permission checks and PermissionsError exceptions. Unauthenticated attackers can invoke tasks including table-statistics (information disclosure), insert-job (resource exhaustion via arbitrary job enqueue), and run-joblist (synchronous execution of maintenance operations), and can target semantic data integrity via entity-disposal operations.

Affected products

  • Semantic MediaWiki Semantic MediaWiki 3.0 through 7.2.x (all versions with smwtask API module)

Timeline

  • 2026-09-18: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.