Semantic MediaWiki CVE-2026-116890

No special conditions - remote unauthenticated exploitation against default configurations of Semantic MediaWiki (3.0.0 through 7.2.1), because the smwtask API module was introduced in 3.x and ships enabled by default with no authorization check. The CSRF token 'gate' is not a limit: MediaWiki hands anonymous callers the fixed public token '+\', so any unauthenticated request satisfies it. The practical LIMITS are impact-related, not access-related: the sensitivity of disclosed statistics scales with how populated the wiki is, and the performance/integrity impact scales with store size and job cost, so an empty or tiny wiki yields little of value. Mitigation per the vendor is upgrading to 7.3.0+, or, if upgrading is not possible, unsetting $GLOBALS['wgAPIModules']['smwtask'] in LocalSettings.php to disable the endpoint.

This is a genuine but moderate-priority issue, and the signals are consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes fully remote, low-complexity, unauthenticated reachability against default installs, which the GHSA advisory corroborates: the smwtask API module performs no authorization check and the only gate (needsToken('csrf')) is satisfied by MediaWiki's fixed public anonymous token '+\'. Impact is deliberately scored low across the board (VC:L/VI:L/VA:L) because the attacker gains internal store statistics and object-ID enumeration (confidentiality), the ability to enqueue/execute maintenance jobs and reach entity-disposal operations that alter semantic data (integrity), and performance degradation via forced synchronous job/query execution (availability) - but not code execution, credential theft, or full data compromise. SSVC reinforces moderate urgency: Exploitation=none (no observed active exploitation and not CISA KEV), Automatable=yes (the whole chain is a handful of unauthenticated HTTP requests against a predictable endpoint, so mass scanning/abuse is feasible), Technical Impact=partial. No EPSS score was supplied, so widespread-exploitation probability cannot be quantified from this input. A detailed, reproduced proof-of-concept is published in the vendor's own GHSA advisory, which raises real-world likelihood above a theoretical finding. Net: real and worth patching (the vuln.today priority is 'this_month'), but it is a lower-impact authorization gap, not a critical RCE - the moderate 6.9 score accurately reflects that.

An unauthenticated attacker fetches the public anonymous CSRF token from api.php, then POSTs to action=smwtask with task=table-statistics to read internal store statistics and enumerate object IDs, and with task=insert-job / task=run-joblist to enqueue and synchronously execute maintenance jobs - degrading performance and, via smw.entityIdDisposer against enumerated IDs, altering stored semantic data. A working proof-of-concept (curl commands reproduced against a default install on master) is published in the vendor GHSA advisory. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this needs only remote, low-complexity, unauthenticated requests with no user interaction.