CVE-2026-116890
HIGH
NVD
CVSS Score
7.3
Severity
HIGH
Published
Oct 27, 2026
Vendor
unknown
Description
Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics, enqueue jobs like smw.entityIdDisposer, and execute queued jobs, degrading performance and altering semantic data.