Semantic MediaWiki CVE-2026-116876

Requires the optional edit-protection feature enabled via $smwgEditProtectionRight set to a right not held by ordinary users (this feature is DISABLED by default - the single biggest limiting factor). The attacker needs an authenticated editor account able to edit an unprotected page in a semantic-enabled namespace but does NOT need the configured protection right (PR:L). No user interaction by a victim is required. Exploitation is limited to installations that have deliberately turned on this feature; default SMW deployments are not exposed. The impact is a self-inflicted and other-editor lockout (denial of edit/move), not data disclosure.

This is a genuine but bounded integrity/availability risk rather than a top-tier emergency. CVSS 4.0 (7.1, HIGH) and my own assessment agree on AV:N/AC:L/PR:L/UI:N with the primary impact on availability (VA:H) - an authenticated low-privilege editor can deny edit/move access to a page indefinitely. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a real-but-not-critical priority. Crucially, exploitation depends on a non-default configuration: $smwgEditProtectionRight must be enabled (it is disabled by default), so the actual exposed population is a subset of SMW installs. No EPSS score was provided and the issue is not in CISA KEV, so there is no signal of widespread automated exploitation; the threat is an insider/low-privilege abuse scenario (any editor) on affected, specifically-configured wikis. Note the input Tag 'Authentication Bypass' conflicts with the evidence - CWE-862 and the advisory describe a missing-authorization (protection) failure, explicitly 'not a read bypass' - so treat the risk as integrity/availability of page-protection state, not credential/authentication circumvention.

On a wiki where $smwgEditProtectionRight is enabled, a disgruntled or malicious ordinary editor who lacks the protection right edits any unprotected semantic-enabled page and adds the annotation [[Is edit protected::true]]. When SMW processes the save, EditProtectionUpdater applies indefinite edit and move restrictions at the configured right without checking the author's permissions, locking out other editors and potentially even administrators who do not hold that specific SMW right. No published weaponized exploit code is confirmed, but the GHSA advisory provides complete step-by-step reproduction and a validation harness confirming the unauthorized code path.