CVE-2026-116890: falha de média gravidade em SemanticMediaWiki
Semantic MediaWiki 3.0.0 before 7.3.0 Missing Authorization via smwtask API
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.2%
Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics, enqueue jobs like smw.entityIdDisposer, and execute queued jobs, degrading performance and altering semantic data.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Produtos afetados
SemanticMediaWiki · SemanticMediaWikiCVEs relacionadas — SemanticMediaWiki
No mesmo produto, das mais perigosas para as menos.
CVE-2025-61682HIGHSemantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributesEPSS 0.4%CVE-2026-116871HIGHSemantic MediaWiki 3.0.0 before 7.3.1 Uncontrolled Recursion via Special:AskEPSS 0.4%CVE-2026-116877HIGHSemantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via #set_recurring_eventEPSS 0.4%CVE-2026-116872HIGHSemantic MediaWiki 3.0.0 before 7.3.1 Denial of Service via Special:Search Compact FiltersEPSS 0.4%CVE-2026-116878HIGHSemantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via Special:PropertyLabelSimilarityEPSS 0.4%CVE-2026-77616MEDIUMSemantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination tokenEPSS 0.3%