Improper Access Controls in BlueSpice by Hallo Welt! GmbH
CVE-2026-24732

6.6MEDIUM

Key Information:

Vendor

Hallo Welt! Gmbh

Status
Bluespice
Vendor
CVE Published:
4 March 2026

What is CVE-2026-24732?

The vulnerability exists within the BlueSpice by Hallo Welt! GmbH, specifically affecting the NSFileRepo extension and certain BlueSpice versions. It allows unauthorized access to files and directories due to improper permission assignments, permitting functionalities that should be protected by Access Control Lists (ACLs). This oversight can lead to unauthorized users bypassing access controls, thereby potentially accessing sensitive information stored within the application.

Affected Version(s)

BlueSpice 5.1 <= 5.1.3

BlueSpice 5.1 <= 5.1.3

BlueSpice 5.2 <= 5.2.0

References

https://en.wiki.bluespice.com/wiki/Security:Security_Advi...

CVSS V4

Score:
6.6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.