Vulnerability · Published Mar 4, 2026 · Assigned by HW

CVE-2026-24732Improper permission checks in Extension:NSFileRepo

Medium 6.6

In plain English

A medium-severity incorrect permission assignment in BlueSpice from Hallo Welt! GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 4.0)6.6Medium

Exploit odds (30 days)0.3%top 76.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Files or Directories Accessible to External Parties, Incorrect Permission Assignment for Critical Resource vulnerability in Hallo Welt! GmbH BlueSpice (Extension:NSFileRepo modules) allows Accessing Functionality Not Properly Constrained by ACLs, Bypassing Electronic Locks and Access Controls.This issue affects BlueSpice: from 5.1 through 5.1.3, from 5.2 through 5.2.0. HINT: Versions provided apply to BlueSpice MediaWiki releases. For Extension:NSFileRepo the affected versions are 3.0 < 3.0.5

Affected products (as reported)

Vendor	Product	Versions
Hallo Welt! GmbH	BlueSpice	5.1 – through 5.1.35.2 – through 5.2.0

Weakness: CWE-552, CWE-732 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/S:P/AU:Y/RE:L

References

https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2026-02