IT SBIT Services
Schneeberger
DEEN
CVE tracker

BlueSpice container: Privilege escalation to sysop via insecure default configuration

CVE-2026-25784Critical 9.3

← All vulnerabilities

Summary

The bluespice/wiki container image of BlueSpice 5.2.3 up to 5.2.7 (images pulled before 2026-10-19 15:37 UTC) has an insecure default for the service token authenticator. If the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED is not set, the IP restriction is disabled. Any user with read access to the wiki, including anonymous users on publicly readable wikis, can obtain an application token via the REST API and get a session with sysop privileges. The CVSS v4.0 base score is 9.3 (Critical) according to the vendor.

Affected

  • Container bluespice/wiki in BlueSpice 5.2.3 to 5.2.6
  • BlueSpice 5.2.7 container images pulled before 2026-10-19 15:37 UTC
  • Not affected: BlueSpice 5.1 and 5.2.1 to 5.2.2 (according to the vendor)

Fixed in

  • BlueSpice 5.2.7 (container images re-published on 2026-10-19 15:37 UTC)
  • Images of 5.2.7 pulled before that time must be pulled again and the containers re-created

Workaround

  • Set the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED of the wiki containers to the CIDR of the internal container network (e.g. 172.18.0.0/16)
  • Or deny access to /rest.php/mws/v1/app-token/generate on the reverse proxy
  • The vendor recommends updating instead; no other workaround is documented.

Exploitation

  • No public proof of concept or known exploitation (KEV) found in the sources.
  • Exploitation requires only read access to the wiki; no valid account is needed on publicly readable wikis.

Our recommendation

  • Identify all BlueSpice container deployments on 5.2.3 to 5.2.6 and any 5.2.7 image pulled before 2026-10-19 15:37 UTC.
  • Update to BlueSpice 5.2.7, pull the image again and re-create the containers (docker compose pull && docker compose up -d).
  • Until the update is done, apply the workaround and restrict anonymous read access where possible.
  • Review logs for unexpected sysop sessions or unusual use of the REST API token endpoint.
  • Monitor the vendor advisory BSSA-2026-07 for further updates.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:48.

Original description (NVD)

Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED was not set. An empty value disables the IP restriction in the token authenticator component (mwstake/mediawiki-component-token-authenticator). As a result, any user with read access to the wiki (anonymous users on publicly readable wikis) could obtain an application token from the REST API and use it to get a session with sysop privileges as the internal service user. This issue affects BlueSpice: from 5.2.3 before 5.2.7, and the 5.2.7 container images published before 2026-10-19 15:37 UTC.

NVD references (2)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed