Vulnerability · Published Oct 23, 2026 · Assigned by HW

CVE-2026-25716BlueSpiceUserManager: Missing authorization in REST endpoints for blocking and unblocking users

High 7.1

In plain English

A high-severity missing authorization in BlueSpice from Hallo Welt! GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.2%top 92.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrators. The REST endpoints /bs-usermanager/v1/block/create and /bs-usermanager/v1/block/delete call UserManager::blockUser() and UserManager::unblockUser(), which do not verify the permissions of the acting user. This allows locking out all administrators (denial of service) and lifting blocks imposed by administrators. This issue affects BlueSpice: from 5.0.0 before 5.1.11, from 5.2.0 before 5.2.7.

Affected products (as reported)

Vendor	Product	Versions
Hallo Welt! GmbH	BlueSpice	5.0.0 – before 5.1.115.2.0 – before 5.2.7

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

References

https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2026-07 vendor-advisory