{"id":"CVE-2026-25784","title":"bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop","summary":"Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's Lo…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-1188","CWE-269"],"vendor":"Hallo Welt! GmbH","product":"bluespice/wiki","affected":["bluespice/wiki >= 5.2.3 < 5.2.7"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T08:54:57.880Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-25784","references":[{"url":"https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2026-07"},{"url":"https://github.com/hallowelt/docker-bluespice-wiki/commit/04b840be565b508f6e741c376970909b69d2a444"}],"tags":["cve.org"],"ingestedAt":"2026-10-23T09:20:44.057Z","slug":"CVE-2026-25784","body":"## Overview\n\nInitialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED was not set. An empty value disables the IP restriction in the token authenticator component (mwstake/mediawiki-component-token-authenticator). As a result, any user with read access to the wiki (anonymous users on publicly readable wikis) could obtain an application token from the REST API and use it to get a session with sysop privileges as the internal service user.\n\nThis issue affects BlueSpice: from 5.2.3 before 5.2.7, and the 5.2.7 container images published before 2026-10-19 15:37 UTC.\n\n## Affected\n\n- `bluespice/wiki >= 5.2.3 < 5.2.7`\n\n## Remediation\n\nUpdate to BlueSpice 5.2.7 or later. Container images of 5.2.7 that were pulled before 2026-10-19 15:37 UTC must be pulled again and the containers re-created.\n\n### Workarounds\n\nSet the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED of the wiki containers to the CIDR of the internal container network, or deny access to the REST path /rest.php/mws/v1/app-token/generate on the reverse proxy.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}