{"id":"CVE-2026-25784","revision":"4f5c082da95e4cda800b5d0f75a1e8c9","records":[{"revision":"4f5c082da95e4cda800b5d0f75a1e8c9","observedAt":"2026-10-23T16:01:20.601+00:00","statement":{"source":"cve-program","id":"CVE-2026-25784","aliases":[],"title":"bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop","description":"Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED was not set. An empty value disables the IP restriction in the token authenticator component (mwstake/mediawiki-component-token-authenticator). As a result, any user with read access to the wiki (anonymous users on publicly readable wikis) could obtain an application token from the REST API and use it to get a session with sysop privileges as the internal service user.\n\nThis issue affects BlueSpice: from 5.2.3 before 5.2.7, and the 5.2.7 container images published before 2026-10-19 15:37 UTC.","state":0,"publishedAt":"2026-10-23T08:54:57.88+00:00","modifiedAt":"2026-10-23T08:54:57.88+00:00","affected":[{"ecosystem":"https://hub.docker.com/r/bluespice/wiki","name":"bluespice/wiki","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Hallo Welt! GmbH\",\n                    \"product\": \"BlueSpice\",\n                    \"collectionURL\": \"https://hub.docker.com/r/bluespice/wiki\",\n                    \"packageName\": \"bluespice/wiki\",\n                    \"repo\": \"https://github.com/hallowelt/docker-bluespice-wiki\",\n                    \"modules\": [\n                        \"Container bluespice/wiki\"\n                    ],\n                    \"programFiles\": [\n                        \"root-fs/app/conf/LocalSettings.php\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"5.2.3\",\n                            \"lessThan\": \"5.2.7\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":9.3,"severity":"CRITICAL"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2026-07","https://github.com/hallowelt/docker-bluespice-wiki/commit/04b840be565b508f6e741c376970909b69d2a444"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-25784","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-25784","identifiers":["CVE-2026-25784"]},"retained":false,"historicalAffected":[]}],"coverage":[]}