CVE-2026-116876

High

Description

Semantic MediaWiki from 2.5.0 before 7.3.1 contains an improper authorization vulnerability that allows ordinary editors to permanently protect pages by adding an Is edit protected annotation. When $smwgEditProtectionRight is enabled, EditProtectionUpdater applies indefinite edit and move restrictions without checking the author's rights, locking other editors and administrators out.

SeverityHigh

CVSS7.1

Exploit probability—

ProductSemantic-mediawiki Semantic Mediawiki

PublishedOct 27, 2026

First seenOct 27, 2026

Weakness typeCWE-862Missing authorization

How to fix

Update

semantic-mediawiki semantic_mediawiki7.3.1 or later

Patches

github.com/SemanticMediaWiki/SemanticMediaWiki/commit/d2a198f42184373bb8604450c46a13a2c28eafa3

Vendor advisories

github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-9824-67pm-c29j

Affected products

Product	Affected versions	Fixed in
semantic-mediawiki semantic_mediawiki	2.5.0 ≤ v < 7.3.1	7.3.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.