{"id":"CVE-2026-25716","kind":"vulnerability","aliases":["CVE-2026-25716"],"related":[],"title":"BlueSpice wiki: any logged-in user can block or unblock accounts","description":"Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrators. The REST endpoints /bs-usermanager/v1/block/create and /bs-usermanager/v1/block/delete call UserManager::blockUser() and UserManager::unblockUser(), which do not verify the permissions of the acting user. This allows locking out all administrators (denial of service) and lifting blocks imposed by administrators.\n\nThis issue affects BlueSpice: from 5.0.0 before 5.1.11, from 5.2.0 before 5.2.7.","summary":"BlueSpice's user manager REST endpoints for blocking and unblocking accounts do not check the caller's permissions. Any authenticated wiki user can lock out administrators or lift blocks that administrators placed.","severity":"high","cvss":7.1,"epss":0.00183,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluespice","mediawiki","other","self-hosted"],"not_affected_if":["unsupported-version-ranges"],"how_to_check":"- Check the installed BlueSpice version with `composer show` or the Special:Version page on the wiki\n- Confirm whether the BlueSpiceUserManager extension is installed and enabled in `LocalSettings.php`","fix":"- Upgrade BlueSpice 5.1.x to `5.1.11` or later\n- Upgrade BlueSpice 5.2.x to `5.2.7` or later","status":"open","published_at":"2026-10-23T09:17:06+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:31:18+00:00","updated_at":"2026-10-25T03:31:18+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-25T03:31:18Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade BlueSpice 5.1.x to `5.1.11` or later\n- Upgrade BlueSpice 5.2.x to `5.2.7` or later","reach":"internet","title":"BlueSpice wiki: any logged-in user can block or unblock accounts","impact":"medium","summary":"BlueSpice's user manager REST endpoints for blocking and unblocking accounts do not check the caller's permissions. Any authenticated wiki user can lock out administrators or lift blocks that administrators placed.","category":"other","nicknames":[],"who_cares":["bluespice","mediawiki","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"any logged-in user locks out all administrators and lifts their blocks","analyst_note":"","how_to_check":"- Check the installed BlueSpice version with `composer show` or the Special:Version page on the wiki\n- Confirm whether the BlueSpiceUserManager extension is installed and enabled in `LocalSettings.php`","needs_analyst":false,"not_affected_if":["unsupported-version-ranges"],"who_is_affected":"BlueSpice 5.0.0 before 5.1.11 and 5.2.0 before 5.2.7 are affected, when the BlueSpiceUserManager extension is present. Any account that can log in to the wiki can use the flaw, so self-registration or broad read-write accounts widen exposure. Wikis on other MediaWiki setups or on versions outside those ranges can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00063,"input_tokens":3507,"output_tokens":559,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-25716':15A,18A '/bs-usermanager/v1/block/create':86C '/bs-usermanager/v1/block/delete':88C '5.0.0':125C '5.1.11':127C '5.2.0':129C '5.2.7':131C 'account':12A,35B,80C 'act':103C 'administr':50B,55B,82C,110C,119C 'affect':122C 'allow':67C,106C 'arbitrari':78C 'authent':44B,69C 'author':58C 'block':9A,32B,53B,75C,116C 'blockus':91C 'bluespic':1A,19B,25B,64C,123C 'bluespiceusermanag':66C 'call':89C 'caller':40B 'check':38B 'cve':13A,16A 'denial':111C 'endpoint':30B,85C 'extens':65C 'gmbh':63C 'hallo':61C 'host':24B 'impos':117C 'includ':81C 'issu':121C 'lift':52B,115C 'lock':48B,107C 'log':5A 'logged-in':4A 'manag':28B 'mediawiki':20B 'miss':57C 'permiss':42B,100C 'place':56B 'privileg':73C 'rest':29B,84C 'self':23B 'self-host':22B 'servic':113C 'special':72C 'unblock':11A,34B,77C 'unblockus':94C 'user':7A,27B,46B,70C,79C,104C 'usermanag':90C,93C 'verifi':98C 'vulner':59C 'welt':62C 'wiki':2A,45B 'without':71C","nicknames":[],"mitigations":[],"who_affected":"BlueSpice 5.0.0 before 5.1.11 and 5.2.0 before 5.2.7 are affected, when the BlueSpiceUserManager extension is present. Any account that can log in to the wiki can use the flaw, so self-registration or broad read-write accounts widen exposure. Wikis on other MediaWiki setups or on versions outside those ranges can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T09:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@bluespice.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-25716","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25716","severity":null,"published_at":"2026-10-23T09:17:06+00:00","modified_at":"2026-10-23T19:57:42+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-25716","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25716","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}