Vulnerability · Published Oct 27, 2026 · Assigned by VulnCheck

CVE-2026-116876Semantic MediaWiki 2.5.0 before 7.3.1 Missing Authorization via Is edit protected

High 7.1

In plain English

A high-severity missing authorization in SemanticMediaWiki from SemanticMediaWiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.2%top 83.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Semantic MediaWiki from 2.5.0 before 7.3.1 contains an improper authorization vulnerability that allows ordinary editors to permanently protect pages by adding an Is edit protected annotation. When $smwgEditProtectionRight is enabled, EditProtectionUpdater applies indefinite edit and move restrictions without checking the author's rights, locking other editors and administrators out.

Affected products (as reported)

Vendor	Product	Versions
SemanticMediaWiki	SemanticMediaWiki	2.5.0 – before 7.3.1

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

References

GitHub Security Advisory (GHSA-9824-67pm-c29j) vendor-advisory
https://github.com/SemanticMediaWiki/SemanticMediaWiki/commit/d2a198f42184373bb8604450c46a13a2c28eafa3 patch
VulnCheck Advisory: Semantic MediaWiki 2.5.0 before 7.3.1 Missing Authorization via Is edit protected third-party-advisory