{"id":"CVE-2026-25784","published":"2026-10-23T09:17:06.943","lastModified":"2026-10-23T19:57:42.660","description":"Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED was not set. An empty value disables the IP restriction in the token authenticator component (mwstake/mediawiki-component-token-authenticator). As a result, any user with read access to the wiki (anonymous users on publicly readable wikis) could obtain an application token from the REST API and use it to get a session with sysop privileges as the internal service user.\n\nThis issue affects BlueSpice: from 5.2.3 before 5.2.7, and the 5.2.7 container images published before 2026-10-19 15:37 UTC.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-269","CWE-1188"],"vendors":[],"products":[],"references":[{"url":"https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2026-07","tags":[]},{"url":"https://github.com/hallowelt/docker-bluespice-wiki/commit/04b840be565b508f6e741c376970909b69d2a444","tags":[]}],"exploitRefs":[{"url":"https://github.com/hallowelt/docker-bluespice-wiki/commit/04b840be565b508f6e741c376970909b69d2a444","tags":[]}],"hasPoc":true,"ai":{"summary":"The default configuration of the BlueSpice container image disables IP-based access control for internal service authentication when a specific environment variable is unset, allowing any user—including anonymous users—to obtain a privileged session token and escalate to sysop privileges.","exploitability":"Exploitation is straightforward for any user with read access to the wiki (including anonymous users on publicly readable instances), requiring only a single API call to request a token and another to exchange it for a privileged session.","blast_radius":"Successful exploitation grants full administrative control over the wiki, enabling data exfiltration, content manipulation, or further lateral movement within connected services.","remediation":"Upgrade to BlueSpice 5.2.7 container images published on or after 2026-10-19 15:37 UTC, or manually set WIKI_SERVICE_TOKEN_AUTH_ALLOWED to a valid CIDR range in LocalSettings.php before deploying the affected versions.","detection":"Look for anomalous REST API requests to the token endpoint (e.g., /rest.php) from anonymous users followed by immediate session creation using the returned token; check authentication logs for internal service user activity originating from external IPs or unauthenticated sessions.","tags":["privilege-escalation","auth-bypass","default-config","token-abuse","wiki"],"model":"garnet-coder","analyzedAt":"2026-10-24T09:00:15.200Z"}}