EUVD-2026-110701
GHSA-fmrr-242f-45jx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain public anonymous CSRF token +\
-
ExploitPOST api.php?action=smwtask with caller-controlled jobs map
-
ExecutionRun arbitrary queued job types in unbounded counts
-
ImpactExhaust resources, bypass page protection, leak executed page titles
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Semantic MediaWiki 7.3.0 must be installed, and the wiki must run a configuration where anonymous users hold the MediaWiki 'edit' right - the stock MediaWiki default, confirmed live on 1.43.9. Under that default no authentication, session, or non-public token is needed: the smwtask module's csrf token check is satisfied by the fixed public anonymous value '+\', and mustBePosted/isWriteMode do not gate anonymous callers because MediaWiki deprecated the 'writeapi' right in 1.32. The three exposed tasks (run-joblist, update, check-query) are mapped to 'edit', so the primary limiting factor is a non-default configuration that denies anonymous users the 'edit' right (e.g., a private or login-to-edit wiki), which closes the hole. The four administrator tasks (insert-job, table-statistics, duplicate-lookup, default) remain correctly denied, so attackers can only run already-queued jobs, not enqueue new ones. |
| Impact | Signals point to a genuine but moderate priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scoring 6.9 confirms a remote, low-complexity, unauthenticated attack with no user interaction, and the GHSA advisory plus VulnCheck source-code analysis substantiate the mechanism in detail. However, all three impact dimensions are rated Low (VC:L/VI:L/VA:L): the attacker leaks page titles, forces semantic-store updates while bypassing page-level protection, and drives unbounded synchronous work - there is no code execution, no bulk data theft, and no destructive integrity impact. It is not in CISA KEV (no evidence of active exploitation), and no EPSS score was supplied, so widespread automated exploitation cannot be confirmed from the data. The vuln.today decision label is 'this_month', not act_now or emergency, which is consistent with a real-but-contained issue. The elevating factors are the zero-authentication requirement and a detailed, live-verified public proof-of-concept in the vendor advisory; the tempering factors are the uniformly Low impacts and dependence on the stock anonymous-edit configuration. Net: patch within the vendor/priority window rather than treat as a drop-everything emergency. |
| Exploit ScenarioDerived | An unauthenticated attacker fetches the fixed public anonymous CSRF token ('+\') from a stock MediaWiki running Semantic MediaWiki 7.3.0 and POSTs to api.php?action=smwtask. Using run-joblist they name an arbitrary job type with an unbounded count to force synchronous, resource-exhausting execution, or use the update task against a sysop-protected page to force a store update and read back its title. A detailed, live-verified public proof-of-concept for exactly this is published in the GitHub Security Advisory (GHSA-rjqv-6r83-pg8v) by VulnCheck. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Missing authorization in Semantic MediaWiki 7.3.0 lets unauthenticated remote callers run queued maintenance jobs of arbitrary type and unbounded count and force semantic-store updates for any title, including pages protected to sysop, through the smwtask API module. The per-task authorization model introduced in 7.3.0 maps run-joblist, update and check-query to the MediaWiki 'edit' right, which anonymous users hold on a stock wiki, and the module's CSRF requirement is satisfied by the fixed public anonymous token '+', so no session or credentials are needed; the four administrator tasks stay correctly denied, so an attacker can run already-queued jobs but not enqueue new ones. Fixed in 7.3.1; a public PoC reference exists in the vendor advisory as verbatim request transcripts (not verified as working exploit code), no KEV entry is associated, and the vuln.today priority is this_month rather than act_now.
RemediationAI
Vendor-released patch: Semantic MediaWiki 7.3.1 fixes the incomplete authorization model, so upgrade mediawiki/semantic-media-wiki from 7.3.0 to 7.3.1 or later following the advisory at https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-rjqv-6r83-pg8v. If the upgrade cannot be applied immediately, the only mitigation the analysis identifies as closing the hole is removing the anonymous 'edit' right so the three exposed tasks (run-joblist, update, check-query) fail their rights check, for example by making the wiki private or login-to-edit ($wgGroupPermissions['*']['edit'] = false); the trade-off is that anonymous page editing stops working entirely, which is a significant change for public wikis, and no in-module control substitutes for it because the mustBePosted, CSRF-token and isWriteMode checks do not gate anonymous callers and the token value is public. As an interim containment measure, restrict or block requests to api.php?action=smwtask at the web server or reverse proxy for unauthenticated clients, accepting that this also breaks the post-edit background-processing calls the module exists for. The vendor's suggested hardening for the patched release, deriving the runnable job set from the subject's pending jobs or requiring smw-admin and capping the job count, adding page-level userCan('edit', ...) checks in UpdateTask and CheckQueryTask, and extending TaskFactoryTest to assert the task-to-right mapping, is only available in 7.3.1. Patch status per vendor is available; the VulnCheck advisory and NVD entry listed above can be used for tracking.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-862 (missing authorization) in the MediaWiki API module api.php?action=smwtask, which Semantic MediaWiki exposes to drive post-edit background work. Release 7.3.0, responding to GHSA-jr78-w6w5-m8f8, added per-task rights declarations: Task::getRequiredPermission() defaults to smw-admin and is checked by $this->checkUserRightsAny() in src/MediaWiki/Api/Task.php before a task executes. Only four tasks override the default, and three of them, run-joblist (JobListTask.php), update (UpdateTask.php) and check-query (CheckQueryTask.php), were mapped to 'edit', a right anonymous users hold in a stock MediaWiki configuration. The module's other surface controls do not compensate: mustBePosted(), needsToken('csrf') and isWriteMode() all pass for anonymous callers because MediaWiki's older 'writeapi' right was deprecated in 1.32 and is no longer enforced, and the anonymous CSRF token is the fixed public value '+'. In JobListTask::process() the subject parameter is used only as a null-guard while the jobs map is entirely caller-supplied and never validated against a type allowlist or an amount cap; SMW\MediaWiki\JobQueue::runFromQueue() then loops per type using the caller's count (feeding array_fill) and pops and runs any registered job class, including other extensions' jobs, returning the prefixed page titles of the jobs it executed. UpdateTask::process() similarly deserialises the caller's subject and runs an UpdateJob for that title while checking only the global 'edit' right, never page-level permission, so sysop-protected pages are updated. Because the work runs synchronously inside the request, unbounded counts translate into resource exhaustion. The CVE record carries a CVSS 4.0 base of 6.9, while the independent assessment scores CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L; the affected package is composer mediawiki/semantic-media-wiki >= 7.3.0, < 7.3.1, matching CPE cpe:2.3:a:semanticmediawiki:semanticmediawiki. The trigger is documented precisely in the advisory, including the request sequence in which an administrator enqueues one smw.parserCachePurgeJob via insert-job and an anonymous caller then drains it via run-joblist.
Know when Mediawiki gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Remote api.php access with the public anonymous token gives AV:N/AC:L/PR:N/UI:N; title disclosure, protection-bypassing updates and unbounded jobs yield C:L/I:L/A:L.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask API module that allows unauthenticated attackers to run queued jobs and force store updates. Attackers can use the public anonymous CSRF token with run-joblist to execute arbitrary job types in unbounded counts, or invoke update on sysop-protected pages, leaking page titles and exhausting resources.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is
The MWOAuthDataStore::lookup_token function in Extension:OAuth for MediaWiki 1.25.x before 1.25.3, 1.24.x before 1.24.4,
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. Rated critical severity (CVSS 9.8), thi
The admin API module in the QuizGame extension for MediaWiki through 1.37.2 (before 665e33a68f6fa1167df99c0aa18ed0157cdf
The SemanticDrilldown extension for MediaWiki through 1.37.2 (before e688bdba6434591b5dff689a45e4d53459954773) allows SQ
An issue was discovered in MediaWiki through 1.37.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely
An issue was discovered in MediaWiki through 1.37.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely
An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. Rated critical severity (CVSS 9.8), this
An issue was discovered in the AbuseFilter extension in MediaWiki through 1.36. Rated critical severity (CVSS 9.8), this
api.php in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has a Reflected File Download vulnera
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foun
An issue was discovered in the FileImporter extension in MediaWiki through 1.36. Rated high severity (CVSS 8.8), this vu
Exploit-DB