Vulnerability Details CVE-2026-116890
Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics, enqueue jobs like smw.entityIdDisposer, and execute queued jobs, degrading performance and altering semantic data.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 8.8%
CVSS Severity
CVSS v3 Score 7.3