{"id":"CVE-2026-25784","state":"PUBLISHED","title":"bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop","description":"Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED was not set. An empty value disables the IP restriction in the token authenticator component (mwstake/mediawiki-component-token-authenticator). As a result, any user with read access to the wiki (anonymous users on publicly readable wikis) could obtain an application token from the REST API and use it to get a session with sysop privileges as the internal service user.\n\nThis issue affects BlueSpice: from 5.2.3 before 5.2.7, and the 5.2.7 container images published before 2026-10-19 15:37 UTC.","publishedAt":"2026-10-23T08:54:57.880Z","updatedAt":"2026-10-23T08:54:57.880Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"HW"},"assigner":"HW","products":["Hallo Welt! GmbH BlueSpice"],"affected":[{"vendor":"Hallo Welt! GmbH","product":"BlueSpice","packageName":"bluespice/wiki","defaultStatus":"unaffected","versions":[{"version":"5.2.3","status":"affected","lessThan":"5.2.7","versionType":"semver"}],"collectionURL":"https://hub.docker.com/r/bluespice/wiki","repo":"https://github.com/hallowelt/docker-bluespice-wiki","modules":["Container bluespice/wiki"],"programFiles":["root-fs/app/conf/LocalSettings.php"]}],"references":["https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2026-07","https://github.com/hallowelt/docker-bluespice-wiki/commit/04b840be565b508f6e741c376970909b69d2a444"],"weaknesses":["CWE-1188","CWE-269"],"ingestedAt":"2026-10-29T20:11:21.040Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/25xxx/CVE-2026-25784.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-25784","state":"PUBLISHED","datePublished":"2026-10-23T08:54:57.880Z","dateUpdated":"2026-10-23T08:54:57.880Z","assignerShortName":"HW","assignerOrgId":"ff95705b-1a40-4639-8017-a58fa868baee","dateReserved":"2026-02-06T14:21:19.086Z"},"containers":{"cna":{"title":"bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop","descriptions":[{"lang":"en","value":"Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED was not set. An empty value disables the IP restriction in the token authenticator component (mwstake/mediawiki-component-token-authenticator). As a result, any user with read access to the wiki (anonymous users on publicly readable wikis) could obtain an application token from the REST API and use it to get a session with sysop privileges as the internal service user.\n\nThis issue affects BlueSpice: from 5.2.3 before 5.2.7, and the 5.2.7 container images published before 2026-10-19 15:37 UTC."}],"affected":[{"vendor":"Hallo Welt! GmbH","product":"BlueSpice","packageName":"bluespice/wiki","defaultStatus":"unaffected","versions":[{"version":"5.2.3","status":"affected","lessThan":"5.2.7","versionType":"semver"}],"collectionURL":"https://hub.docker.com/r/bluespice/wiki","repo":"https://github.com/hallowelt/docker-bluespice-wiki","modules":["Container bluespice/wiki"],"programFiles":["root-fs/app/conf/LocalSettings.php"]}],"references":[{"url":"https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2026-07","tags":["vendor-advisory"]},{"url":"https://github.com/hallowelt/docker-bluespice-wiki/commit/04b840be565b508f6e741c376970909b69d2a444","tags":["patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"CRITICAL","baseScore":9.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"CRITICAL","baseScore":9.8,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}},{"other":{"type":"Note","content":{"text":"Scored for wikis that allow anonymous read access, where no privileges are required. In the default (non-public) BlueSpice configuration, reading the wiki requires a login (PR:L; CVSS 4.0: 8.7 / CVSS 3.1: 8.8, HIGH)."}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1188","lang":"en","description":"CWE-1188 Initialization of a Resource with an Insecure Default","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-269","lang":"en","description":"CWE-269 Improper Privilege Management","type":"CWE"}]}],"providerMetadata":{"shortName":"HW","orgId":"ff95705b-1a40-4639-8017-a58fa868baee","dateUpdated":"2026-10-23T08:54:57.880Z"},"datePublic":"2026-10-19T00:00:00.000Z","impacts":[{"capecId":"CAPEC-233","descriptions":[{"lang":"en","value":"CAPEC-233 Privilege Escalation"}]}],"workarounds":[{"lang":"en","value":"Set the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED of the wiki containers to the CIDR of the internal container network, or deny access to the REST path /rest.php/mws/v1/app-token/generate on the reverse proxy.","supportingMedia":[{"type":"text/html","base64":false,"value":"Set the environment variable <code>WIKI_SERVICE_TOKEN_AUTH_ALLOWED</code> of the wiki containers to the CIDR of the internal container network, or deny access to the REST path <code>/rest.php/mws/v1/app-token/generate</code> on the reverse proxy."}]}],"solutions":[{"lang":"en","value":"Update to BlueSpice 5.2.7 or later. Container images of 5.2.7 that were pulled before 2026-10-19 15:37 UTC must be pulled again and the containers re-created.","supportingMedia":[{"type":"text/html","base64":false,"value":"Update to BlueSpice 5.2.7 or later. Container images of 5.2.7 that were pulled before 2026-10-19 15:37 UTC must be pulled again and the containers re-created."}]}],"source":{"discovery":"INTERNAL"},"x_generator":{"engine":"Hallo Welt! CERT"}}}}}