GHSA-jr78-w6w5-m8f8

### Summary The `api.php?action=smwtask` API module performs no authorization check. The equivalent maintenance interface in the web UI (`Special:SMWAdmin`) requires the `smw-admin` right, but the API module that backs several of the same operations enforces nothing. An unauthenticated visitor can therefore retrieve internal Semantic MediaWiki database statistics and reach state-changing maintenance operations that are intended to be administrator-only. ### Details `SMW\MediaWiki\Api\Task::execute()` (`src/MediaWiki/Api/Task.php`) reads the request parameters, resolves a task through `TaskFactory`, and runs it. It contains no permission check — no `smw-admin`, no `checkUserRightsAny()`, no per-task right. The only gates on the module are: - `needsToken( 'csrf' )` — this is **not** authorization. MediaWiki issues anonymous users a fixed, public CSRF token (`+\`), so any unauthenticated caller satisfies the token check. It defends logged-in users against CSRF; it does nothing against a direct anonymous request. - `mustBePosted()` / `isWriteMode()` — do not gate on group membership. By contrast, `Special:SMWAdmin` restricts access via `parent::__construct( 'SMWAdmin', 'smw-admin' )` and raises `PermissionsError` when the `smw-admin` right is absent. The API path bypasses that restriction entirely. Tasks reachable anonymously through the module include: - `table-statistics`, `duplicate-lookup` — return internal store statistics and enumerate the internal object-ID space (intended to be behind `Special:SMWAdmin` → Supplementary functions). - `insert-job` — enqueues any Semantic MediaWiki job type (including `smw.fulltextSearchTableRebuild`, `smw.propertyStatisticsRebuild`, `smw.entityIdDisposer`) for an arbitrary title. - `update`, `check-query`, `run-joblist` — run update jobs and `#ask` queries synchronously within the request; `run-joblist` pops and executes queued jobs inline. Because the read tasks disclose the internal object-ID space and `insert-job` can