Semantic MediaWiki'a Missing Authorization In The Smwtask API Module Allows Unauthenticated Access To Admin-only Mainten

Summary The "api.php?action=smwtask" API module performs no authorization check. The equivalent maintenance interface in the web UI "Special:SMWAdmin" requires the "smw-admin" right, but the API module that backs several of the same operations enforces nothing. An unauthenticated visitor can...