BlueSpice vulnerabilities

2 known vulnerabilities in BlueSpice from Hallo Welt!. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  BlueSpice: Improper Privilege Management

  CVE-2026-25784Oct 23, 2026Hallo Welt!

  Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was int

• 7.1 High severity

  BlueSpice: Missing Authorization

  CVE-2026-25716Oct 23, 2026Hallo Welt!

  Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrators. The REST endpoints /bs-usermanage