Read the docs
TI-2026-79597 Aliases CVE-2026-25784GHSA-xrr7-cjx6-x9j2

Insecure default token auth in BlueSpice wiki enables sysop access

Priority MEDIUM 48CWE-1188Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

BlueSpice from 5.2.3 before 5.2.7, and its 5.2.7 container images published before 2026-10-19 15:37 UTC (container image bluespice/wiki), uses an insecure default for the service token authenticator's allowed network range. When the WIKI_SERVICE_TOKEN_AUTH_ALLOWED environment variable is not set, the default becomes an empty string, which disables the IP restriction. An unauthenticated attacker, or any user with read access to the wiki, can obtain an application token from the REST API and use it to get a session with sysop privileges as the internal service user (CWE-1188).

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED was not set. An empty value disables the IP restriction in the token authenticator component (mwstake/mediawiki-component-token-authenticator). As a result, any user with read access to the wiki (anonymous users on publicly readable wikis) could obtain an application token from the REST API and use it to get a session with sysop privileges as the internal service user. This issue affects BlueSpice: from 5.2.3 before 5.2.7, and the 5.2.7 container images published before 2026-10-19 15:37 UTC.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00345 28th percentileScored 2026-11-07
Fix Fixed BlueSpice (Hallo Welt! GmbH): 5.2.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Hallo Welt! GmbHBlueSpice5.2.3 to before 5.2.75.2.7Patch availableCNA
  • BlueSpice VendorHallo Welt! GmbH Affected 5.2.3 to before 5.2.7 Fixed in 5.2.7 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:hallowelt:bluespice:*:*:*:*:*:*:*:*——Hallo Welt! GmbH
  • cpe:2.3:a:hallowelt:bluespice:*:*:*:*:*:*:*:* Versions — — ·Hallo Welt! GmbH

Remediation

Upgrade BlueSpice to 5.2.7 or later. The sources list no fixed version for the 5.2.7 container images published before 2026-10-19 15:37 UTC, so use container images published on or after that time.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

  • Fix · CNA BlueSpice (Hallo Welt! GmbH) Fixed in 5.2.7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Hallo Welt! BlueSpice — en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSS…

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-79596 Missing authorization in BlueSpiceUserManager lets users block accountsPriority LOW 30
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-25784
  2. 2026-10-23 Alias added: GHSA-xrr7-cjx6-x9j2
  3. 2026-11-02 CISA SSVC decision points changed

References

Patch 1

Advisory 1

  • TI-2026-19937 Improper permission checks in Extension:NSFileRepo CVSS 4.0MEDIUM 6.6
  • TI-2026-79596 Missing authorization in BlueSpiceUserManager lets users block accounts CVSS 4.0HIGH 7.1
  • TI-2022-02320 Potential XSS in title URL parameter CVSS 3.1MEDIUM 6.1
  • TI-2022-02319 Potential XSS on Special:SearchCenter CVSS 3.1MEDIUM 6.1
  • TI-2022-03572 Potential XSS in common user interface component library CVSS 3.1MEDIUM 6.1
  • TI-2025-35941 Potential XSS in Extension:CognitiveProcessDesigner CVSS 4.0MEDIUM 5.9
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences