Insecure Default Initialization in BlueSpice by Hallo Welt! GmbH

CVE-2026-25784

What is CVE-2026-25784?

A Resource in BlueSpice is initialized with an insecure default setting that allows privilege escalation. When the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED is not set, the $mwsgTokenAuthenticatorServiceCIDR evaluates to an empty string. This absence of a value leads to the disabling of IP restrictions in the token authenticator component, which poses a significant risk. Users with read access, including anonymous users on publicly accessible wikis, can exploit this vulnerability to acquire an application token from the REST API, granting them session access with sysop privileges as the internal service user.

References