Hallo Welt! BlueSpice up to 5.2.6 Token Authenticator LocalSettings.php mwsgTokenAuthenticatorServiceCIDR default permission

Summaryinfo

A vulnerability, which was classified as critical, has been found in Hallo Welt! BlueSpice up to 5.2.6. The affected element is an unknown function of the file LocalSettings.php of the component Token Authenticator. This manipulation of the argument mwsgTokenAuthenticatorServiceCIDR causes default permission. The identification of this vulnerability is CVE-2026-25784. It is possible to initiate the attack remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Hallo Welt! BlueSpice up to 5.2.6. Affected by this vulnerability is an unknown functionality of the file LocalSettings.php of the component Token Authenticator. The manipulation of the argument mwsgTokenAuthenticatorServiceCIDR with an unknown input leads to a default permission vulnerability. The CWE definition for the vulnerability is CWE-276. During installation, installed file permissions are set to allow anyone to modify those files. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED was not set. An empty value disables the IP restriction in the token authenticator component (mwstake/mediawiki-component-token-authenticator). As a result, any user with read access to the wiki (anonymous users on publicly readable wikis) could obtain an application token from the REST API and use it to get a session with sysop privileges as the internal service user. This issue affects BlueSpice: from 5.2.3 before 5.2.7, and the 5.2.7 container images published before 2026-10-19 15:37 UTC.

The advisory is shared at en.wiki.bluespice.com. This vulnerability is known as CVE-2026-25784 since 02/06/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1222 for this issue.

By approaching the search of inurl:LocalSettings.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 5.2.7 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-108653). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Hallo Welt!

Name

• BlueSpice

Version

• 5.2.0
• 5.2.1
• 5.2.2
• 5.2.3
• 5.2.4
• 5.2.5
• 5.2.6

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion