CVE-2026-25784: bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-23 · updated 2026-10-23
Weakness: CWE-269

Description

Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED was not set. An empty value disables the IP restriction in the token authenticator component (mwstake/mediawiki-component-token-authenticator). As a result, any user with read access to the wiki (anonymous users on publicly readable wikis) could obtain an application token from the REST API and use it to get a session with sysop privileges as the internal service user. This issue affects BlueSpice: from 5.2.3 before 5.2.7, and the 5.2.7 container images published before 2026-10-19 15:37 UTC.

Affected products

Hallo Welt! GmbH BlueSpice: from 5.2.3 before 5.2.7 — fixed in 5.2.7

How to fix

Upgrade to a fixed version: Hallo Welt! GmbH BlueSpice 5.2.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-25784 or the next vulnerability affects your stack