Vulnerability · Published Oct 23, 2026 · Assigned by HW
CVE-2026-25784bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop
Critical 9.8
In plain English
A critical-severity privilege mismanagement in BlueSpice from Hallo Welt! GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).
Official description
Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED was not set. An empty value disables the IP restriction in the token authenticator component (mwstake/mediawiki-component-token-authenticator). As a result, any user with read access to the wiki (anonymous users on publicly readable wikis) could obtain an application token from the REST API and use it to get a session with sysop privileges as the internal service user. This issue affects BlueSpice: from 5.2.3 before 5.2.7, and the 5.2.7 container images published before 2026-10-19 15:37 UTC.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Hallo Welt! GmbH | BlueSpice | 5.2.3 – before 5.2.7 |
Weakness: CWE-1188, CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H