CVE-2026-25716 Details
Description
Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrators. The REST endpoints /bs-usermanager/v1/block/create and /bs-usermanager/v1/block/delete call UserManager::blockUser() and UserManager::unblockUser(), which do not verify the permissions of the acting user. This allows locking out all administrators (denial of service) and lifting blocks imposed by administrators. This issue affects BlueSpice: from 5.0.0 before 5.1.11, from 5.2.0 before 5.2.7.
A missing authorization vulnerability has been identified in Hallo Welt! GmbH BlueSpice, specifically in the BlueSpice User Manager extension. This vulnerability allows any authenticated user without special privileges to block or unblock user accounts, including those of administrators. The issue arises because the REST endpoints for blocking and unblocking users do not verify the permissions of the user making the request. As a result, it is possible to lock out administrators, creating a denial-of-service situation, and to remove blocks that administrators have imposed. This vulnerability affects BlueSpice versions 5.0.0 prior to 5.1.11 and 5.2.0 prior to 5.2.7.
Users can update to BlueSpice 5.1.11 or 5.2.7, both of which require the 'wikiadmin' permission to manage user accounts. BlueSpice cloud instances will be updated automatically.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2026-07 | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Hallo Welt! GmbH BlueSpice | >= 5.0.0, <= 5.1.10 (semver) >= 5.2.0, <= 5.2.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |