---
id: CVE-2026-25784
title: >-
  bluespice/wiki container: Insecure default configuration of service token
  authentication allows privilege escalation to sysop
summary: >-
  Initialization of a Resource with an Insecure Default vulnerability in Hallo
  Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege
  escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the
  container's Lo…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-1188
  - CWE-269
vendor: Hallo Welt! GmbH
product: bluespice/wiki
affected:
  - bluespice/wiki >= 5.2.3 < 5.2.7
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T08:54:57.880Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-25784'
references:
  - url: >-
      https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2026-07
  - url: >-
      https://github.com/hallowelt/docker-bluespice-wiki/commit/04b840be565b508f6e741c376970909b69d2a444
tags:
  - cve.org
ingestedAt: '2026-10-23T09:20:44.057Z'
---

## Overview

Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED was not set. An empty value disables the IP restriction in the token authenticator component (mwstake/mediawiki-component-token-authenticator). As a result, any user with read access to the wiki (anonymous users on publicly readable wikis) could obtain an application token from the REST API and use it to get a session with sysop privileges as the internal service user.

This issue affects BlueSpice: from 5.2.3 before 5.2.7, and the 5.2.7 container images published before 2026-10-19 15:37 UTC.

## Affected

- `bluespice/wiki >= 5.2.3 < 5.2.7`

## Remediation

Update to BlueSpice 5.2.7 or later. Container images of 5.2.7 that were pulled before 2026-10-19 15:37 UTC must be pulled again and the containers re-created.

### Workarounds

Set the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED of the wiki containers to the CIDR of the internal container network, or deny access to the REST path /rest.php/mws/v1/app-token/generate on the reverse proxy.