Authorization Flaw in BlueSpice UserManager by Hallo Welt! GmbH
CVE-2026-25716

7.1HIGH

Key Information:

Vendor

Hallo Welt! Gmbh

Status
Bluespice
Vendor
CVE Published:
23 October 2026

What is CVE-2026-25716?

The BlueSpice UserManager extension by Hallo Welt! GmbH contains a critical weakness where authenticated users, lacking sufficient privileges, can manipulate user accounts. Specifically, the REST endpoints responsible for blocking and unblocking users do not enforce permission checks. This oversight allows potential attackers to lock out all administrators, leading to a denial of service scenario, or to remove blocks set by administrators on various user accounts. Versions affected include BlueSpice from 5.0.0 to before 5.1.11 and from 5.2.0 to before 5.2.7.

Affected Version(s)

BlueSpice 5.0.0 < 5.1.11

BlueSpice 5.2.0 < 5.2.7

References

https://en.wiki.bluespice.com/wiki/Security:Security_Advi...
vendor-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

kta1kri
.