CVE-2026-25784

Summary

The default configuration of the BlueSpice container image disables IP-based access control for internal service authentication when a specific environment variable is unset, allowing any user—including anonymous users—to obtain a privileged session token and escalate to sysop privileges.

Exploitability

Exploitation is straightforward for any user with read access to the wiki (including anonymous users on publicly readable instances), requiring only a single API call to request a token and another to exchange it for a privileged session.

Blast radius

Successful exploitation grants full administrative control over the wiki, enabling data exfiltration, content manipulation, or further lateral movement within connected services.

Detection

Look for anomalous REST API requests to the token endpoint (e.g., /rest.php) from anonymous users followed by immediate session creation using the returned token; check authentication logs for internal service user activity originating from external IPs or unauthenticated sessions.

Prioritized remediation

Upgrade to BlueSpice 5.2.7 container images published on or after 2026-10-19 15:37 UTC, or manually set WIKI_SERVICE_TOKEN_AUTH_ALLOWED to a valid CIDR range in LocalSettings.php before deploying the affected versions.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.