AIKIDO-2026-777865

TL;DR

The smwtask API module's authorization check in Semantic MediaWiki only validates a CSRF token and does not verify the caller is authorized for the page named in the request. An unauthenticated caller can still queue background jobs and force store updates for a page they cannot edit, an incomplete fix for a prior advisory that stopped at token enforcement without a per page authorization check. The patch adds a per page authorization check in the task dispatch path before the task runs.