---
id: "CVE-2026-25716"
kind: "vulnerability"
aliases: ["CVE-2026-25716"]
title: "BlueSpice wiki: any logged-in user can block or unblock accounts"
severity: "high"
cvss: 7.1
epss: 0.00183
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["bluespice", "mediawiki", "other", "self-hosted"]
not_affected_if: ["unsupported-version-ranges"]
published_at: "2026-10-23T09:17:06+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T03:31:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25716", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25716", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# BlueSpice wiki: any logged-in user can block or unblock accounts

BlueSpice's user manager REST endpoints for blocking and unblocking accounts do not check the caller's permissions. Any authenticated wiki user can lock out administrators or lift blocks that administrators placed.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed BlueSpice version with `composer show` or the Special:Version page on the wiki
- Confirm whether the BlueSpiceUserManager extension is installed and enabled in `LocalSettings.php`

## Fix

- Upgrade BlueSpice 5.1.x to `5.1.11` or later
- Upgrade BlueSpice 5.2.x to `5.2.7` or later

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-25716
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-25716

## From the sources

Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrators. The REST endpoints /bs-usermanager/v1/block/create and /bs-usermanager/v1/block/delete call UserManager::blockUser() and UserManager::unblockUser(), which do not verify the permissions of the acting user. This allows locking out all administrators (denial of service) and lifting blocks imposed by administrators.

This issue affects BlueSpice: from 5.0.0 before 5.1.11, from 5.2.0 before 5.2.7.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_