CVE-2026-25784

CriticalCVSS 9.8

Published: 23/10/2026(UTC)Translated: 23/10/2026(UTC)NVD NIST

Summary

In the BlueSpice container image (bluespice/wiki), the default value of $mwsgTokenAuthenticatorServiceCIDR in LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the WIKI_SERVICE_TOKEN_AUTH_ALLOWED environment variable was not set. An empty value disables the IP restriction in the token authenticator component, allowing any user with read access to the wiki to obtain a token from the REST API and get a session with sysop privileges as the internal service user.

Risk Assessment

On publicly readable wikis, an anonymous user can gain administrative (sysop) privileges, leading to full compromise of the platform. The risk affects BlueSpice container deployments in versions 5.2.3–5.2.6 and 5.2.7 images published before 2026-10-19 15:37 UTC.

Recommendation

Update BlueSpice to version 5.2.7 or later (images published after the stated date) and ensure the WIKI_SERVICE_TOKEN_AUTH_ALLOWED variable is set so the CIDR restriction works correctly.

Other vulnerabilities in BlueSpice

CVE-2026-25716High
The BlueSpiceUserManager extension in BlueSpice lacks authorization checks in the REST endpoints /bs-usermanager/v1/block/create and /bs-usermanager/v1/block/delete. Any authenticated user without special privileges can block or unblock arbitrary accounts, including administrators.

Original NVD description (English source)

Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED was not set. An empty value disables the IP restriction in the token authenticator component (mwstake/mediawiki-component-token-authenticator). As a result, any user with read access to the wiki (anonymous users on publicly readable wikis) could obtain an application token from the REST API and use it to get a session with sysop privileges as the internal service user. This issue affects BlueSpice: from 5.2.3 before 5.2.7, and the 5.2.7 container images published before 2026-10-19 15:37 UTC.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS