Semantic MediaWiki CVE-2026-116879

Requires the Semantic MediaWiki extension at an affected version (7.3.0 through 7.3.1-alpha) to be installed, an account holding the wiki-wide 'edit' right, and a valid CSRF token. The attacker supplies a fully caller-controlled serialized 'subject' parameter naming a page they are not authorized to edit; no non-default SMW setting beyond the standard smwtask update task exposure is needed. Limiting factors: the caller must hold the 'edit' right and present a CSRF token (on hardened wikis this requires an account, though on wikis permitting anonymous editing the 'edit' right - and thus the attack - is available to anonymous users per the patch commentary); and impact is bounded to forced reparsing, semantic-store writes, cache invalidation, and expensive dependency work, not to altering the protected page's wikitext content.

This is a genuine but moderate-priority issue, not a top-tier emergency. The provided CVSS 4.0 base score is 6.9 (Medium) driven by VI:L and VA:L with VC:N - the impact is integrity of the semantic store and targeted resource consumption, not data disclosure or code execution. No EPSS score was provided and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation; exploitation status is best described as 'no public exploit identified at time of analysis,' though a public PoC reference exists in the GHSA advisory that is not verified as working exploit code (the advisory explicitly states it is source-predicted and 'no live wiki request was made'). The vuln.today decision label is 'this_month,' consistent with a patch-on-normal-cadence rather than drop-everything posture. There is a notable conflict in the signals: the supplied CVSS 4.0 vector carries PR:N (unauthenticated), yet the GHSA advisory states the attacker needs the ordinary 'edit' right plus a CSRF token - verify the authentication precondition with the vendor advisory, since the two sources disagree. The patch commentary partially reconciles this by noting that an anonymous caller may hold the 'edit' right on wikis configured to allow anonymous editing, which would make PR:N correct only in that specific configuration.

An account holding the ordinary wiki-wide 'edit' right obtains a valid CSRF token and a serialized subject value for a page it is not allowed to edit, then sends a single smwtask update request. The smwtask module authorizes the edit right globally rather than against the named title, so it constructs a FORCED_UPDATE UpdateJob for the restricted page, forcing reparsing and semantic-store writes outside the attacker's authorization boundary. A source-predicted PoC exists in the GHSA advisory; it is not verified as working exploit code.