CVE-2026-25716

HighCVSS 7.1

Published: 23/10/2026(UTC)Translated: 23/10/2026(UTC)NVD NIST

Summary

The BlueSpiceUserManager extension in BlueSpice lacks authorization checks in the REST endpoints /bs-usermanager/v1/block/create and /bs-usermanager/v1/block/delete. Any authenticated user without special privileges can block or unblock arbitrary accounts, including administrators.

Risk Assessment

An attacker can lock out all administrator accounts, causing denial of service, or lift blocks imposed by administrators. This undermines access control and account management security across the BlueSpice installation.

Recommendation

Update BlueSpice to version 5.1.11 or 5.2.7 (or later). Until patched, restrict access to the /bs-usermanager/v1/block/* endpoints at the web server or WAF level.

Other vulnerabilities in BlueSpice

CVE-2026-25784Critical
In the BlueSpice container image (bluespice/wiki), the default value of $mwsgTokenAuthenticatorServiceCIDR in LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the WIKI_SERVICE_TOKEN_AUTH_ALLOWED environment variable was not set. An empty value disables the IP restriction in the token authenticator component, allowing any user with read access to the wiki to obtain a token from the REST API and get a session with sysop privileges as the internal service user.

Original NVD description (English source)

Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrators. The REST endpoints /bs-usermanager/v1/block/create and /bs-usermanager/v1/block/delete call UserManager::blockUser() and UserManager::unblockUser(), which do not verify the permissions of the acting user. This allows locking out all administrators (denial of service) and lifting blocks imposed by administrators. This issue affects BlueSpice: from 5.0.0 before 5.1.11, from 5.2.0 before 5.2.7.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS