CVE-2026-25716— BlueSpiceUserManager: Missing authorization in REST endpoints for blocking and unblocking users
Quick assessment
Affected
Hallo Welt! GmbH BlueSpice
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Hallo Welt! GmbH 开发的 BlueSpice（扩展：BlueSpiceUserManager）存在缺失授权（Missing Authorization）漏洞。该漏洞允许任何已认证但无特殊权限的用户，随意阻断或解除其他用户账户（包括管理员账户）的封锁状态。 具体而言，REST 端点 和 调用了 和 方法，但这些方法并未验证当前操作用户的权限。攻击者可利用此漏洞封锁所有管理员账户（导致拒绝服务），或解除由管理员施加的封锁。 受影响的版本包括： BlueSpice 5.0.0 至 5.1.10（即 5.0
Possible ATT&CK Techniques 2 AI
T1068 · Exploitation for Privilege Escalation T1548.001 · Setuid and Setgid
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-25716
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
BlueSpiceUserManager: Missing authorization in REST endpoints for blocking and unblocking users
Source: CVE Program / CVE List V5
Vulnerability Description
Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrators. The REST endpoints /bs-usermanager/v1/block/create and /bs-usermanager/v1/block/delete call UserManager::blockUser() and UserManager::unblockUser(), which do not verify the permissions of the acting user. This allows locking out all administrators (denial of service) and lifting blocks imposed by administrators.
This issue affects BlueSpice: from 5.0.0 before 5.1.11, from 5.2.0 before 5.2.7.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Hallo Welt! GmbH | BlueSpice | 5.0.0 ~ 5.1.11 | - |
|
II. Public POCs for CVE-2026-25716
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-25716
请登录查看更多情报信息。
Other References for CVE-2026-25716 (1)
IV. Related Vulnerabilities
Same product: BlueSpice
-
CVE-2026-25784
bluespice/wiki container: Insecure default configuration of -
CVE-2026-24732
Improper permission checks in Extension:NSFileRepo -
CVE-2025-58114
Potential XSS in Extension:CognitiveProcessDesigner -
CVE-2025-57880
Potential XSS in Extension:BlueSpiceWhoIsOnline -
CVE-2025-48007
Potential XSS in Extension:BlueSpiceAvatars
Same vendor: Hallo Welt! GmbH
-
CVE-2026-25784
bluespice/wiki container: Insecure default configuration of -
CVE-2026-24732
Improper permission checks in Extension:NSFileRepo -
CVE-2025-58114
Potential XSS in Extension:CognitiveProcessDesigner -
CVE-2025-57880
Potential XSS in Extension:BlueSpiceWhoIsOnline -
CVE-2025-48007
Potential XSS in Extension:BlueSpiceAvatars
Same weakness: CWE-862
-
CVE-2026-112359
WordPress WPMobile.App plugin <= 11.86 - Broken Access Contr -
CVE-2026-112825
WordPress Car Rental Manager plugin <= 1.5.3 - Broken Access -
CVE-2026-112821
WordPress Knit Pay plugin <= 9.6.3.0 - Broken Access Control -
CVE-2026-115373
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5 -
CVE-2026-115364
OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Qui
V. Comments for CVE-2026-25716
No comments yet