Extension:BlueSpiceUserManager vulnerabilities

CVEs whose affected-version data names the Extension:BlueSpiceUserManager package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-25716High· 7.1

today

BlueSpiceUserManager: Missing authorization in REST endpoints for blocking and unblocking users

Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrators. The REST e…

▾ TwilightHallo Welt! GmbH · Extension:BlueSpiceUserManagervia CVEORG