Semantic MediaWiki CVE-2026-116878

Exploitation requires the Special:PropertyLabelSimilarity special page to be reachable by anonymous users, which is the default - the GHSA confirms the special-page constructor sets no restriction and no SMW administrator permission is required. The attacker supplies limit=0 (or a negative value), which the vulnerable getPropertyList() treats as 'no SQL LIMIT', loading the whole property table into the O(n^2) matchLabels()/similar_text() loop. The key LIMITING factor is deployment scale: the advisory states the cost grows quadratically with the number of user-defined properties, so the attack is only meaningfully disruptive on a wiki with a large property pool; on a small property set the request may simply return a normal HTML page. No authentication, user interaction, or special configuration beyond a public wiki is needed, and impact is availability-only.

This is a genuine but bounded availability risk, not a confidentiality/integrity threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity reachability with no user interaction, and the vulnerable-availability metric VA:H drives the 8.7 score - this is a pure denial-of-service issue (VC:N/VI:N). The SSVC framework tempers this: Exploitation is rated 'none' (no observed or confirmed exploitation), Technical Impact is only 'partial', while Automatable is 'yes' (the limit=0 request is trivially scriptable and repeatable). There is no EPSS score and no CISA KEV listing in the input, so there is no signal of active or widespread exploitation. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a readily-automatable availability bug that is not being exploited. A material caveat: real-world impact is conditional on scale - the GHSA explicitly states the cost grows quadratically with the number of user-defined properties, so a wiki with a small property pool may only return a normal page, while a large pool times out. The advisory's own suggested severity is 'Medium', which is lower than the 8.7 (High) CVSS 4.0 base, reflecting that the worst case depends on deployment size. Net: prioritize patching within the vendor-suggested week for internet-facing SMW wikis with large property pools, but this is not a drop-everything emergency and carries no data-exposure risk.

An anonymous attacker scripts repeated HTTP GET requests to a public wiki's Special:PropertyLabelSimilarity page with limit=0, which disables the SQL LIMIT and forces the backend to load the entire property pool and run pairwise similar_text() comparisons. Because the work is quadratic in the number of user-defined properties, a handful of concurrent requests can saturate PHP CPU and memory and hold database connections, degrading availability for legitimate users. The GHSA includes a safe, source-predicted proof of concept (a single limit=0&threshold=101 request); it is presented as source-review-predicted behavior, not a production stress test.