CVE-2026-25716High· 7.1▾ TwilightMissing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrators. The REST e…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrators. The REST endpoints /bs-usermanager/v1/block/create and /bs-usermanager/v1/block/delete call UserManager::blockUser() and UserManager::unblockUser(), which do not verify the permissions of the acting user. This allows locking out all administrators (denial of service) and lifting blocks imposed by administrators.
This issue affects BlueSpice: from 5.0.0 before 5.1.11, from 5.2.0 before 5.2.7.
Extension:BlueSpiceUserManager >= 5.0.0 < 5.1.11Extension:BlueSpiceUserManager >= 5.2.0 < 5.2.7Update to BlueSpice 5.1.11 or 5.2.7 or later.
Deny access to the REST paths /rest.php/bs-usermanager/v1/block/create and /rest.php/bs-usermanager/v1/block/delete on the web server or reverse proxy. Note that this also disables enabling/disabling users from Special:UserManager.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-25784Critical· 9.8bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop
CVE-2025-12924Medium· 4.3A vulnerability was identified in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224
CVE-2024-0829Medium· 4.3The Comments Extra Fields For Post,Pages and CPT plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.0
CVE-2025-13772High· 7.1GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated user to access and utilize AI model settings from unauthorize…
CVE-2023-4630Medium· 5.0Missing Authorization in GitLab
CVE-2022-20572Medium· 6.7In verity_target of dm-verity-target.c, there is a possible way to modify read-only files due to a missing permission check