Semantic MediaWiki Improper Authorization in Edit Protection

Semantic MediaWiki from 2.5.0 before 7.3.1 contains an improper authorization vulnerability that allows ordinary editors to permanently protect pages by adding an Is edit protected annotation. When $smwgEditProtectionRight is enabled, EditProtectionUpdater applies indefinite edit and move restrictions without checking the author's rights, locking other editors and administrators out.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Semantic MediaWiki versions 2.5.0 through 7.3.1 contain a critical authorization bypass that allows ordinary editors to lock pages indefinitely. When the $smwgEditProtectionRight configuration is enabled, the EditProtectionUpdater mechanism fails to verify user permissions before applying edit and move restrictions through an "Is edit protected" annotation. This means any user with basic editing privileges can permanently protect pages, effectively locking out administrators and other editors—a denial of service against legitimate content management. Organizations running vulnerable Semantic MediaWiki instances on collaborative platforms, wikis, and knowledge bases are at immediate risk of operational disruption and unauthorized access control manipulation.

Casky's 283 mapped skills detect the attack patterns underlying this vulnerability by analyzing Privilege Escalation (TA0004) and Credential Access (TA0006) techniques through Claude's extended reasoning capabilities. Practitioners using Casky would identify suspicious annotation modifications in page histories where low-privileged users suddenly add protection metadata, coupled with audit log anomalies showing permission changes without corresponding administrative actions. The platform's security skills would flag unauthorized authorization state changes—specifically CWE-862 (Missing Authorization) patterns—by correlating user roles against protection operations and detecting cases where edit restrictions are applied by accounts lacking the necessary rights. Practitioners would see findings highlighting which users performed protection annotations, when protections became indefinite, and which legitimate editors were subsequently locked out, enabling rapid incident response and rollback.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-116876.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-116876

Casky has 283 skills that investigate the attack patterns behind CVE-2026-116876. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn