GHSA-JR78-W6W5-M8F8: Missing Authorization in Semantic MediaWiki smwtask API Module Allows Unauthenticated Administrative Actions

Vulnerability ID: GHSA-JR78-W6W5-M8F8
CVSS Score: 7.3
Published: 2026-09-18

Semantic MediaWiki starting from version 3.0.0 up to and including 7.2.1 is vulnerable to an unauthenticated missing authorization flaw in its smwtask API module. The endpoint fails to execute permission or privilege checks on callers. Instead, it relies on a CSRF token check, which can be satisfied by anonymous users using MediaWiki's static public CSRF token. Remote, unauthenticated attackers can exploit this flaw to retrieve internal database statistics, enqueue background jobs, run database queries, or trigger entity disposal processes, potentially leading to information disclosure, database corruption, and Denial of Service.

TL;DR

A missing authorization vulnerability in Semantic MediaWiki's smwtask API allows unauthenticated remote attackers to execute administrative maintenance tasks, corrupt semantic data, and trigger Denial of Service by leveraging MediaWiki's default anonymous CSRF token.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-862: Missing Authorization
• Attack Vector: Network (Unauthenticated)
• CVSS v3.1 Score: 7.3 (High)
• Impact: Data Disclosure, Data Corruption, Denial of Service (DoS)
• Exploit Status: Proof of Concept (PoC)
• Remediation Status: Patched in version 7.3.0

Affected Systems

• Semantic MediaWiki installations running versions 3.0.0 through 7.2.1
• semantic-media-wiki: >= 3.0.0, <= 7.2.1 (Fixed in: 7.3.0)

Exploit Details

• GitHub Security Advisory: Functional curl commands and JSON structures to reproduce authorization bypass on smwtask endpoint

Mitigation Strategies

• Upgrade Semantic MediaWiki to version 7.3.0 or higher.
• Disable the vulnerable smwtask module in LocalSettings.php as a temporary workaround.

Remediation Steps:

1. Open the command terminal and navigate to the MediaWiki installation directory.
2. Run the command: composer update mediawiki/semantic-media-wiki to update the extension.
3. If upgrading is not immediately possible, edit your LocalSettings.php file.
4. Append the hotfix code to unregister the smwtask module.
5. Save the configuration and verify that accessing api.php?action=smwtask returns an unrecognized action error.

References

• GitHub Advisory Database Entry
• GitHub Security Advisory (Source)
• Vulnerable Source Code (v7.2.1)
• Patched Source Code (v7.3.0)

Read the full report for GHSA-JR78-W6W5-M8F8 on our website for more details including interactive diagrams and full exploit analysis.