Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-25784— bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop

Quick assessment

Affected
Hallo Welt! GmbH BlueSpice
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Hallo Welt! GmbH 的 BlueSpice（容器镜像 bluespice/wiki）中存在“资源初始化使用不安全默认值”漏洞，可导致权限提升。该漏洞源于容器镜像的 文件中， 的默认值本意是将内部服务认证限制在容器网络内，但当环境变量 未设置时，该值会被评估为空字符串。空字符串会导致 token 认证组件（mwstake/mediawiki-component-token-authenticator）禁用 IP 限制。因此，任何拥有 wiki 读取权限的用户（在公开可读的 wiki 中包括匿名用户）均可

CVSS 9.8 · Critical EPSS 0.34% · P27

Affected Version Matrix 1

VendorProduct Version RangeStatus
Hallo Welt! GmbH BlueSpice 5.2.3< 5.2.7 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-25784

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop
Source: CVE Program / CVE List V5
Vulnerability Description
Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED was not set. An empty value disables the IP restriction in the token authenticator component (mwstake/mediawiki-component-token-authenticator). As a result, any user with read access to the wiki (anonymous users on publicly readable wikis) could obtain an application token from the REST API and use it to get a session with sysop privileges as the internal service user. This issue affects BlueSpice: from 5.2.3 before 5.2.7, and the 5.2.7 container images published before 2026-10-19 15:37 UTC.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不安全的默认资源初始化
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Hallo Welt! GmbH BlueSpice 5.2.3 ~ 5.2.7 -

II. Public POCs for CVE-2026-25784

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-25784

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-25784 (1)

IV. Related Vulnerabilities

Same product: BlueSpice
Same vendor: Hallo Welt! GmbH
Same weakness: CWE-1188

V. Comments for CVE-2026-25784

No comments yet

Leave a comment