The vulnerability is a missing authorization flaw in the smwtask module of Semantic MediaWiki. Because the API endpoint accepts requests from unauthenticated users, an attacker can invoke admin‑level maintenance tasks such as reading internal statistics, enqueuing jobs like smw.entityIdDisposer, and executing queued jobs. This can lead to unauthorized data manipulation and temporary denial of service due to performance degradation. The flaw is identified as CWE‑862.

Affected systems include Semantic MediaWiki installations from version 3.0.0 up to, but not including, 7.3.0. Any site deploying these versions is vulnerable. The vulnerability is present in the smwtask module of api.php and is specific to Semantic MediaWiki.

The CVSS score of 6.9 indicates a medium severity risk. The EPSS score is not available, and the CVE is not listed in the CISA KEV catalog, but the vulnerability can be exploited by anyone with network access to the MediaWiki installation, using an autogenerated anonymous CSRF token. Because the flaw allows execution of protected maintenance functions without authentication, the potential impact is significant, especially in environments where semantic data integrity and uptime are critical. Prompt remediation is recommended.