Cpe:2.3:a:hallo_welt:bluespice:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3ahallo_weltbluespice/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 23 Oct 2026 09:35:59 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgHallo Welt! GmbH BlueSpice: Missing Authorization in BlueSpiceUserManager (CVE-2026-25716)https://feed.craftedsignal.io/briefs/2026-10-bluespice-auth-bypass/Fri, 23 Oct 2026 09:35:59 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-bluespice-auth-bypass/A missing authorization vulnerability in the BlueSpiceUserManager extension allows authenticated users to block or unblock arbitrary accounts, enabling administrative account lockout or unauthorized access restoration.CVE-2026-25716 is a missing authorization vulnerability in the BlueSpiceUserManager extension for BlueSpice wiki software. The vulnerability exists within the REST endpoints '/bs-usermanager/v1/block/create' and '/bs-usermanager/v1/block/delete'. These endpoints fail to verify if the acting user possesses the required administrative permissions before invoking 'UserManager::blockUser()' or 'UserManager::unblockUser()'. Authenticated users can exploit this to disable any account, including administrators, or reverse existing blocks.

Impact

Successful exploitation allows for the denial of service (DoS) by locking out administrative users or the circumvention of security controls by lifting administrative blocks on restricted accounts.

Recommendation

  • Inventory instances of BlueSpice running the BlueSpiceUserManager extension.
  • Upgrade BlueSpice instances to version 5.1.11 or later for the 5.1.x branch, or 5.2.7 or later for the 5.2.x branch.
  • Implement strict monitoring of requests to the '/bs-usermanager/v1/block/' API path to identify unauthorized account modification attempts.
]]>criticaladvisoryweb-applicationprivilege-escalationauthorization-bypasscloudcontainer-security