CVE-2026-25784 Details
Description
Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED was not set. An empty value disables the IP restriction in the token authenticator component (mwstake/mediawiki-component-token-authenticator). As a result, any user with read access to the wiki (anonymous users on publicly readable wikis) could obtain an application token from the REST API and use it to get a session with sysop privileges as the internal service user. This issue affects BlueSpice: from 5.2.3 before 5.2.7, and the 5.2.7 container images published before 2026-10-19 15:37 UTC.
A vulnerability allowing privilege escalation has been identified in Hallo Welt! GmbH BlueSpice, specifically in the container image bluespice/wiki, versions 5.2.3 prior to 5.2.7, and the 5.2.7 images published before October 19, 2026. The issue arises from the default configuration of the $mwsgTokenAuthenticatorServiceCIDR variable in LocalSettings.php, which was meant to restrict internal service authentication to the container network. However, when the WIKI_SERVICE_TOKEN_AUTH_ALLOWED environment variable was not set, the default value evaluated to an empty string, disabling the IP restriction in the token authenticator component. This flaw allowed any user with read access to the wiki, including anonymous users on publicly readable wikis, to obtain an application token from the REST API and gain sysop privileges as the internal service user.
Users should update to BlueSpice 5.2.7. For those using the BlueSpice 5.2.7 container images, ensure to pull the latest version and recreate the containers. After updating, verify the installation by checking the TokenAuthenticatorServiceCIDR setting in LocalSettings.php. If the configuration has been misused, consult the BlueSpice support.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2026-07 | [email protected] | AdvisoryBundleRemedyVendor |
| https://github.com/hallowelt/docker-bluespice-wiki/commit/04b840be565b508f6e741c376970909b69d2a444 | [email protected] | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1188 | Initialization of a Resource with an Insecure Default | [email protected] |
| CWE-269 | Improper Privilege Management | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Hallo Welt! GmbH BlueSpice | >= 5.2.3, < 5.2.7 (semver) >= 5.2.7, < 2026-10-19T15:37:00Z >= 5.0.0, <= 5.1.10 (semver) >= 5.2.0, <= 5.2.6 (semver) >= 5.1, <= 5.1.11 >= 5.2, <= 5.2.7 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |