BlueSpice (5.2.3 <= Version < 5.2.7)

A missing authorization vulnerability in the BlueSpiceUserManager extension allows authenticated users to block or unblock arbitrary accounts, enabling administrative account lockout or unauthorized access restoration.