{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-25784","assignerOrgId":"ff95705b-1a40-4639-8017-a58fa868baee","state":"PUBLISHED","assignerShortName":"HW","dateReserved":"2026-02-06T14:21:19.086Z","datePublished":"2026-10-23T08:54:57.880Z","dateUpdated":"2026-10-23T08:54:57.880Z"},"containers":{"cna":{"providerMetadata":{"orgId":"ff95705b-1a40-4639-8017-a58fa868baee","shortName":"HW","dateUpdated":"2026-10-23T08:54:57.880Z"},"title":"bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop","datePublic":"2026-10-19T00:00:00.000Z","problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-1188","description":"CWE-1188 Initialization of a Resource with an Insecure Default","type":"CWE"}]},{"descriptions":[{"lang":"en","cweId":"CWE-269","description":"CWE-269 Improper Privilege Management","type":"CWE"}]}],"impacts":[{"capecId":"CAPEC-233","descriptions":[{"lang":"en","value":"CAPEC-233 Privilege Escalation"}]}],"affected":[{"vendor":"Hallo Welt! GmbH","product":"BlueSpice","collectionURL":"https://hub.docker.com/r/bluespice/wiki","packageName":"bluespice/wiki","repo":"https://github.com/hallowelt/docker-bluespice-wiki","modules":["Container bluespice/wiki"],"programFiles":["root-fs/app/conf/LocalSettings.php"],"versions":[{"status":"affected","version":"5.2.3","lessThan":"5.2.7","versionType":"semver"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED was not set. An empty value disables the IP restriction in the token authenticator component (mwstake/mediawiki-component-token-authenticator). As a result, any user with read access to the wiki (anonymous users on publicly readable wikis) could obtain an application token from the REST API and use it to get a session with sysop privileges as the internal service user.\n\nThis issue affects BlueSpice: from 5.2.3 before 5.2.7, and the 5.2.7 container images published before 2026-10-19 15:37 UTC.","supportingMedia":[{"type":"text/html","base64":false,"value":"Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image <code>bluespice/wiki</code>) allows privilege escalation. The default value of <code>$mwsgTokenAuthenticatorServiceCIDR</code> in the container's <code>LocalSettings.php</code> was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the environment variable <code>WIKI_SERVICE_TOKEN_AUTH_ALLOWED</code> was not set. An empty value disables the IP restriction in the token authenticator component (<code>mwstake/mediawiki-component-token-authenticator</code>). As a result, any user with read access to the wiki (anonymous users on publicly readable wikis) could obtain an application token from the REST API and use it to get a session with sysop privileges as the internal service user.<p>This issue affects BlueSpice: from 5.2.3 before 5.2.7, and the 5.2.7 container images published before 2026-10-19 15:37 UTC.</p>"}]}],"references":[{"url":"https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2026-07","tags":["vendor-advisory"]},{"url":"https://github.com/hallowelt/docker-bluespice-wiki/commit/04b840be565b508f6e741c376970909b69d2a444","tags":["patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"CRITICAL","baseScore":9.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"CRITICAL","baseScore":9.8,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}},{"other":{"type":"Note","content":{"text":"Scored for wikis that allow anonymous read access, where no privileges are required. In the default (non-public) BlueSpice configuration, reading the wiki requires a login (PR:L; CVSS 4.0: 8.7 / CVSS 3.1: 8.8, HIGH)."}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"workarounds":[{"lang":"en","value":"Set the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED of the wiki containers to the CIDR of the internal container network, or deny access to the REST path /rest.php/mws/v1/app-token/generate on the reverse proxy.","supportingMedia":[{"type":"text/html","base64":false,"value":"Set the environment variable <code>WIKI_SERVICE_TOKEN_AUTH_ALLOWED</code> of the wiki containers to the CIDR of the internal container network, or deny access to the REST path <code>/rest.php/mws/v1/app-token/generate</code> on the reverse proxy."}]}],"solutions":[{"lang":"en","value":"Update to BlueSpice 5.2.7 or later. Container images of 5.2.7 that were pulled before 2026-10-19 15:37 UTC must be pulled again and the containers re-created.","supportingMedia":[{"type":"text/html","base64":false,"value":"Update to BlueSpice 5.2.7 or later. Container images of 5.2.7 that were pulled before 2026-10-19 15:37 UTC must be pulled again and the containers re-created."}]}],"source":{"discovery":"INTERNAL"},"x_generator":{"engine":"Hallo Welt! CERT"}}}}