The CVE-2026-116890 vulnerability in Semantic MediaWiki's smwtask API module allows unauthenticated access to admin-only maintenance tasks. The API module lacks authorization checks, enabling retrieval of internal database statistics and execution of state-changing maintenance operations intended for administrators only. This issue arises from the module's failure to enforce proper authorization, unlike t [truncated]
The CVE-2026-116891 vulnerability is a residual reflected XSS issue in Semantic MediaWiki's Special:FacetedSearch feature, caused by unescaped user-controlled input in the cstate hidden inputs. This vulnerability was confirmed in version 7.2.0 and the default branch at HEAD 18f418b4cdf2875e67a741349179a22c1573f61c. The affected code locations are src/MediaWiki/Specials/FacetedSearch/HtmlBuilder.php:131-13 [truncated]
