Semantic MediaWiki CVE-2026-116880

Exploitation requires that the victim is a logged-in user holding the smw-admin right with an active session in the browser, AND that the specific maintenance feature being targeted (e.g. table schema setup via action=updatetables, entity disposal, or job enqueue/stop) is enabled in the wiki. The attacker is unauthenticated but cannot act directly: they must get the admin to visit an attacker-controlled page or follow a crafted link (UI:P), at which point the admin's session cookie supplies authority automatically. The root condition is in SpecialAdmin::execute(), which writes the current user's valid getEditToken() into wpEditToken before dispatch, and in handlers such as TableSchemaTaskHandler::handleRequest() that perform state-changing operations without a POST or matchEditToken() check. Limiting factors: no self-service attacker access (a privileged victim is mandatory), the targeted feature must be enabled, and the admin's browser must send the request with session credentials to a reachable wiki instance.

This is a genuine but bounded risk, not a drop-everything emergency. The CVSS 4.0 base score is 7.1 with AV:N/AC:L/AT:N/PR:N/UI:P, and the impact profile is integrity-and-availability only (VI:L/VA:H, VC:N) - this is a CSRF (CWE-352) that causes destructive semantic-data changes, schema disruption, and resource exhaustion, NOT confidentiality loss or remote code execution. The PR:N reflects that the attacker needs no account of their own, but exploitation is gated by UI:P plus two real prerequisites from the advisory: the victim must already be an authenticated smw-admin and the targeted maintenance feature must be enabled. Signals are partly conflicting and partly missing: no EPSS score was provided, so statistical exploitation likelihood cannot be assessed; the CVE is not listed in CISA KEV, so there is no confirmed active exploitation; and the proof of concept in the GHSA advisory is explicitly source-predicted (derived from source review, 'not executed against a live wiki'), so it is a PoC reference rather than verified working exploit code. The vuln.today decision label is 'this_week', consistent with a real but non-emergency priority. Net: a high-CVSS issue whose real-world risk is moderate and conditional - dangerous for exposed admin workflows, but limited by the requirement that a logged-in smw-admin be socially engineered into visiting a malicious page.

An attacker sends an authenticated Semantic MediaWiki administrator (smw-admin) a link or embeds an auto-loading request in a web page or email; when the admin's browser visits it, the victim's session cookie is automatically attached to a cross-origin request to Special:SMWAdmin (e.g. action=updatetables). Because SpecialAdmin::execute() overwrites the request's wpEditToken with a freshly generated valid token before dispatch, the maintenance handler runs store->setup() or a job action with no effective CSRF check, triggering schema setup, entity disposal, or job enqueue/stop. A public PoC reference exists in the GHSA advisory but it is source-predicted and not verified as working exploit code, and exploitation still requires the victim to be an authenticated admin with the relevant feature enabled.