GHSA-jr78-w6w5-m8f8: Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks

September 18, 2026

The api.php?action=smwtask API module performs no authorization check. The equivalent maintenance interface in the web UI (Special:SMWAdmin) requires the smw-admin right, but the API module that backs several of the same operations enforces nothing. An unauthenticated visitor can therefore retrieve internal Semantic MediaWiki database statistics and reach state-changing maintenance operations that are intended to be administrator-only.

References

github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.3.0
github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-jr78-w6w5-m8f8
github.com/advisories/GHSA-jr78-w6w5-m8f8

Code Behaviors & Features

Detect and mitigate GHSA-jr78-w6w5-m8f8 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →