CVE-2026-116890 SemanticMediaWiki CVE debrief

Who should care

Defenders responsible for Semantic MediaWiki instances, administrators, and security teams should assess exposure and prioritize patching or mitigation to prevent unauthorized access.

Why it matters

The CVE-2026-116890 vulnerability in Semantic MediaWiki's smwtask API module allows unauthenticated access to admin-only maintenance tasks, potentially leading to unauthorized access to internal database statistics and execution of state-changing maintenance operations. Defenders should prioritize verifying exposure, assessing potential impact, and applying patches or mitigations to prevent unauthorized access.

• Potential unauthorized access to internal database statistics
• Potential execution of state-changing maintenance operations by unauthorized users
• Need for verification of instance exposure and potential impact
• Priority for patching or mitigating vulnerable instances

Technical summary

The smwtask API module in Semantic MediaWiki lacks authorization checks, allowing unauthenticated access to internal database statistics and state-changing maintenance operations. The vulnerability is fixed in version 7.3.0. This issue arises from the module's failure to enforce proper authorization, unlike the equivalent web UI interface which requires the 'smw-admin' right. Technical details indicate that the API module performs no permission check, relying only on a CSRF token which does not serve as authorization. Defenders should prioritize verifying exposure, assessing potential impact, and applying patches or mitigations to prevent unauthorized access to Semantic MediaWiki instances.

Defensive priority

Defenders should prioritize verifying exposure, assessing potential impact, and applying patches or mitigations to prevent unauthorized access to Semantic MediaWiki instances.

Recommended defensive actions

• Verify Semantic MediaWiki instance exposure and assess potential impact
• Apply patches or mitigations to prevent unauthorized access
• Monitor for suspicious activity on Semantic MediaWiki instances
• Restrict access to the smwtask API module for non-administrators
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is confirmed in Semantic MediaWiki versions up to 7.2.1. The fix is included in version 7.3.0. Limited information is available on potential exploits or attacks. Evidence is based on public CVE and NVD records, as well as developer documentation. Defenders should verify instance exposure and assess potential impact based on available information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.