Live › vulnerability › CVE-2026-25784
Go to dashboardThe bluespice/wiki container ships an insecure default that disables an IP restriction on its internal token authenticator when WIKI_SERVICE_TOKEN_AUTH_ALLOWED is unset. Anyone who can read the wiki, including anonymous users on public wikis, can get an application token and a sysop session as the internal service user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
5.2.3 before 5.2.7, or a 5.2.7 image published before 2026-10-19 15:37 UTC5.2.7 and pull a container image published after 2026-10-19 15:37 UTCEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED was not set. An empty value disables the IP restriction in the token authenticator component (mwstake/mediawiki-component-token-authenticator). As a result, any user with read access to the wiki (anonymous users on publicly readable wikis) could obtain an application token from the REST API and use it to get a session with sysop privileges as the internal service user.
This issue affects BlueSpice: from 5.2.3 before 5.2.7, and the 5.2.7 container images published before 2026-10-19 15:37 UTC.
This page as .md · .json · in your agent: get_signal("CVE-2026-25784")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.