SemanticMediaWiki CVE-2026-116888

Exploitation requires an account holding the smw-schemaedit right, which the vendor states is granted by default only to the curator and administrator groups; the attacker must save a property group schema whose canonical_name holds a markup payload (validation pattern '^(.*)$' imposes no restriction) and whose property_keys names a property present on a browsable page. The targeted property must have no explicit 'Is property group' annotation so that the schema list path resolves the crafted group. Execution additionally requires a victim to view the Special:Browse page of a page carrying that member property (reflected in UI:P) - the script runs only in that viewer's browser, so impact scales with the privilege of whoever browses (an administrator viewing the page is the high-impact case). Limiting factors: the required elevated, restricted smw-schemaedit right (not available to ordinary users) and the mandatory victim interaction of opening the affected Special:Browse page.

This is a genuine but moderate-priority issue, not a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P, base 4.8 Medium) and the detailed GHSA evidence agree on the mechanism: PR:H reflects that exploitation requires the smw-schemaedit right, which the advisory states is granted by default only to the curator and administrator groups, and UI:P reflects that a victim must actually view the affected Special:Browse page. The vuln.today Decision label is 'this_month', consistent with a stored XSS gated behind an elevated right rather than an unauthenticated internet-facing flaw. It is NOT in CISA KEV (no confirmed active exploitation), and no EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here - do not read the absence of EPSS/KEV as either safety or active exploitation. A documented proof-of-concept (payload, schema JSON, and a confirmed reproduction) exists inside the GHSA advisory. The notable threat model is privilege crossing: a lower-trust curator who holds smw-schemaedit but cannot normally run script in another user's session can plant a payload that fires in an administrator's authenticated session, making full admin takeover a plausible downstream consequence if an admin views the page. One data conflict must be flagged: the embedded GHSA 'Affected Versions' section states 'Fix status: not fixed / No fixed release exists at the time of review' and gives a lower bound of 3.0.0, whereas the CVE/EUVD metadata and the final package line confirm the flaw is fixed in 7.3.1 with an affected range of 3.2.0 to <7.3.1 - the advisory body reflects an earlier review snapshot now superseded by the vendor fix.

A user holding the smw-schemaedit right (by default a curator or administrator) saves a property group schema whose canonical_name field contains markup such as '<img src=x onerror=alert(document.domain)>', naming a property that appears on a browsable page with no explicit group annotation. When any other user - critically, an administrator - opens that page's Special:Browse view, GroupFormatter emits the canonical_name verbatim as the section heading and the JavaScript executes in that viewer's authenticated session. A working proof-of-concept with the exact payload and a confirmed reproduction is published in the GHSA advisory.