TI-2026-79596 Aliases CVE-2026-25716 GHSA-vr6v-xrj8-f9m9

Missing authorization in BlueSpiceUserManager lets users block accounts

LOW 30CWE-862Published 2026-10-23 · Updated 2026-10-29

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Missing authorization in Hallo Welt GmbH BlueSpice (Extension:BlueSpiceUserManager) lets any authenticated user without special privileges block or unblock arbitrary user accounts, including administrators. The REST endpoints for blocking and unblocking do not check the permissions of the acting user, which allows locking out all administrators and lifting blocks that administrators imposed. This affects BlueSpice from 5.0.0 before 5.1.11 and from 5.2.0 before 5.2.7.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrators. The REST endpoints /bs-usermanager/v1/block/create and /bs-usermanager/v1/block/delete call UserManager::blockUser() and UserManager::unblockUser(), which do not verify the permissions of the acting user. This allows locking out all administrators (denial of service) and lifting blocks imposed by administrators. This issue affects BlueSpice: from 5.0.0 before 5.1.11, from 5.2.0 before 5.2.7.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00183 7th percentileScored 2026-11-07

Fix Fixed BlueSpice (Hallo Welt! GmbH): 5.1.11, 5.2.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Hallo Welt! GmbH	BlueSpice	5.0.0 to before 5.1.11; 5.2.0 to before 5.2.7	5.1.11, 5.2.7	Patch available	CNA

BlueSpice VendorHallo Welt! GmbH Affected 5.0.0 to before 5.1.11; 5.2.0 to before 5.2.7 Fixed in 5.1.11, 5.2.7 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:hallowelt:bluespice::::::::	—	—	Hallo Welt! GmbH

cpe:2.3:a:hallowelt:bluespice:*:*:*:*:*:*:*:* Versions — — ·Hallo Welt! GmbH

Remediation

Update BlueSpice to 5.1.11 or 5.2.7, which fix the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA BlueSpice (Hallo Welt! GmbH) Fixed in 5.1.11, 5.2.7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2026-10-23
Hallo Welt! BlueSpice — en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSS…
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-79597 Insecure default token auth in BlueSpice wiki enables sysop accessPriority MEDIUM 48
Show all 2 records → Advisory →

Timeline

2026-10-23 Threatist record created from CVE-2026-25716
2026-10-23 Alias added: GHSA-vr6v-xrj8-f9m9
2026-10-23 Priority changed: MEDIUM → LOW
2026-10-29 CISA SSVC decision points changed

References

Advisory 1

https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2026-07

TI-2026-79597 Insecure default token auth in BlueSpice wiki enables sysop access CVSS 4.0CRITICAL 9.3
TI-2026-19937 Improper permission checks in Extension:NSFileRepo CVSS 4.0MEDIUM 6.6
TI-2022-02320 Potential XSS in title URL parameter CVSS 3.1MEDIUM 6.1
TI-2022-02319 Potential XSS on Special:SearchCenter CVSS 3.1MEDIUM 6.1
TI-2022-03572 Potential XSS in common user interface component library CVSS 3.1MEDIUM 6.1
TI-2025-35941 Potential XSS in Extension:CognitiveProcessDesigner CVSS 4.0MEDIUM 5.9

See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences