CVE-2026-25784
Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice…
- Risk score
- 69/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 23 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A vulnerability in BlueSpice (container image bluespice/wiki) allows privilege escalation due to an insecure default value in LocalSettings.php. An attacker could obtain an application token from the REST API and use it to gain sysop privileges.
- Affected
- {'products': ['BlueSpice'], 'packages': ['bluespice/wiki'], 'versions': ['5.2.3 before 5.2.7', '5.2.7 container images published ...']}
- Fix
- Upgrade to BlueSpice 5.2.7 or later
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED was not set. An empty value disables the IP restriction in the token authenticator component (mwstake/mediawiki-component-token-authenticator). As a result, any user with read access to the wiki (anonymous users on publicly readable wikis) could obtain an application token from the REST API and use it to get a session with sysop privileges as the internal service user. This issue affects BlueSpice: from 5.2.3 before 5.2.7, and the 5.2.7 container images published before 2026-10-19 15:37 UTC.
Last activity 23 Oct 2026. Patch Forecast updates every hour.