{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://hub.docker.com/r/bluespice/wiki","packageName":"bluespice/wiki","product":"BlueSpice","source":"CNA: HW","vendor":"Hallo Welt! GmbH","versions":[{"lessThan":"5.2.7","status":"affected","version":"5.2.3","versionType":"semver"}]}],"cveId":"CVE-2026-25784","cwes":["CWE-1188","CWE-269"],"description":"Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED was not set. An empty value disables the IP restriction in the token authenticator component (mwstake/mediawiki-component-token-authenticator). As a result, any user with read access to the wiki (anonymous users on publicly readable wikis) could obtain an application token from the REST API and use it to get a session with sysop privileges as the internal service user.\n\nThis issue affects BlueSpice: from 5.2.3 before 5.2.7, and the 5.2.7 container images published before 2026-10-19 15:37 UTC.","epss":{"date":"2026-11-01","percentile":0.28143,"score":0.00345},"exploits":[],"kev":null,"metrics":[{"score":9.3,"severity":"critical","source":"CNA: HW","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},{"score":9.8,"severity":"critical","source":"CNA: HW","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793625963282,"publishedAt":1792745697880,"references":[{"source":"CNA: HW","tags":["vendor-advisory"],"url":"https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2026-07"},{"source":"CNA: HW","tags":["patch"],"url":"https://github.com/hallowelt/docker-bluespice-wiki/commit/04b840be565b508f6e741c376970909b69d2a444"}],"remediation":[{"kind":"fix","source":"CNA: HW","text":"Update to BlueSpice 5.2.7 or later. Container images of 5.2.7 that were pulled before 2026-10-19 15:37 UTC must be pulled again and the containers re-created."},{"kind":"workaround","source":"CNA: HW","text":"Set the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED of the wiki containers to the CIDR of the internal container network, or deny access to the REST path /rest.php/mws/v1/app-token/generate on the reverse proxy."}],"revision":"e3697a1675bd171fb89509f7e32fe5e5ac0bed54ecca799ca0a30b27c131ee74","sources":[{"modifiedAt":1793625963282,"name":"CNA: HW","retrievedAt":1793628540708,"url":"https://www.cve.org/CVERecord?id=CVE-2026-25784"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793628543331,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25784"}],"ssvc":{"assessedAt":1793625872786,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop","updatedAt":1793628543331}