Hallo Welt! GmbH BlueSpice: Missing Authorization in BlueSpiceUserManager (CVE-2026-25716)
A missing authorization vulnerability in the BlueSpiceUserManager extension allows authenticated users to block or unblock arbitrary accounts, enabling administrative account lockout or unauthorized access restoration.
CVE search metadata
CVE search record: CVE-2026-25716. Severity: high. CVSS: 7.1. KEV: no. Product: BlueSpice (5.0.0-5.1.10), BlueSpice (5.2.0-5.2.6), BlueSpice (5.2.3 <= version < 5.2.7), BlueSpice (container image bluespice/wiki <= 2026-10-19 15:37 UTC). Brief: Hallo Welt! GmbH BlueSpice: Missing Authorization in BlueSpiceUserManager (CVE-2026-25716). Brief link: https://feed.craftedsignal.io/briefs/2026-10-bluespice-auth-bypass/
CVE search record: CVE-2026-25784. Severity: critical. CVSS: 9.8. KEV: no. Product: BlueSpice (5.0.0-5.1.10), BlueSpice (5.2.0-5.2.6), BlueSpice (5.2.3 <= version < 5.2.7), BlueSpice (container image bluespice/wiki <= 2026-10-19 15:37 UTC). Brief: Hallo Welt! GmbH BlueSpice: Missing Authorization in BlueSpiceUserManager (CVE-2026-25716). Brief link: https://feed.craftedsignal.io/briefs/2026-10-bluespice-auth-bypass/
Triage facts
Revision 1- Applicability
- BlueSpice (5.0.0-5.1.10), BlueSpice (5.2.0-5.2.6) +2
- Evidence
- Unknown
- Severity
- Critical
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 23, 09:35 UTC
- Detection
- 1 rule
- Vulnerabilities
- 2 CVEs
- Source quality
- A5Likely
What's new
- 1. severity → critical; added CVE-2026-25784 Oct 23, 09:36 via nvd
CVE-2026-25716 is a missing authorization vulnerability in the BlueSpiceUserManager extension for BlueSpice wiki software. The vulnerability exists within the REST endpoints '/bs-usermanager/v1/block/create' and '/bs-usermanager/v1/block/delete'. These endpoints fail to verify if the acting user possesses the required administrative permissions before invoking 'UserManager::blockUser()' or 'UserManager::unblockUser()'. Authenticated users can exploit this to disable any account, including administrators, or reverse existing blocks.
Impact
Successful exploitation allows for the denial of service (DoS) by locking out administrative users or the circumvention of security controls by lifting administrative blocks on restricted accounts.
Recommendation
- Inventory instances of BlueSpice running the BlueSpiceUserManager extension.
- Upgrade BlueSpice instances to version 5.1.11 or later for the 5.1.x branch, or 5.2.7 or later for the 5.2.x branch.
- Implement strict monitoring of requests to the '/bs-usermanager/v1/block/' API path to identify unauthorized account modification attempts.
Immediate actions
Upgrade BlueSpice to version 5.1.11 or 5.2.7
Upgrade affected BlueSpice instances to 5.2.7 or replace container images with versions tagged after 2026-10-19 15:37 UTC.
Threat Hunt
Analyze access logs for anomalous volume of POST requests to /bs-usermanager/v1/block/ endpoints
Data: Web server access logs
Search web access logs for unusual REST API activity involving token authentication requests from unexpected client IP addresses.
Data: Web server access logs
Mitigations
Upgrade BlueSpice to 5.1.11 or later
CVE-2026-25716
Set WIKI_SERVICE_TOKEN_AUTH_ALLOWED environment variable to the correct container network CIDR.
CVE-2026-25784
Detection coverage 1
Detect CVE-2026-25716 Exploitation - Unauthorized Account Modification
highDetects unauthorized attempts to block or unblock users by monitoring API requests to the vulnerable BlueSpiceUserManager endpoints.
Detection queries are available on the platform. Get full rules →