CVE-2026-25784

🗓️ 23 Oct 2026 08:54:57Reported by HWType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 38 Views🌐 WEB

Insecure default configuration in BlueSpice container allows privilege escalation to sysop.

Reporter	Title	Published	Views	Family All 5
Circl	CVE-2026-25784	23 Oct 202609:05	–	circl
Cvelist	CVE-2026-25784 bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop	23 Oct 202608:54	–	cvelist
EUVD	EUVD-2026-108653	23 Oct 202608:54	–	euvd
NVD	CVE-2026-25784	23 Oct 202609:17	–	nvd
Positive Technologies	PT-2026-28128	25 Mar 202600:00	–	ptsecurity

[
  {
    "vendor": "Hallo Welt! GmbH",
    "product": "BlueSpice",
    "collectionURL": "https://hub.docker.com/r/bluespice/wiki",
    "packageName": "bluespice/wiki",
    "repo": "https://github.com/hallowelt/docker-bluespice-wiki",
    "modules": [
      "Container bluespice/wiki"
    ],
    "programFiles": [
      "root-fs/app/conf/LocalSettings.php"
    ],
    "versions": [
      {
        "status": "affected",
        "version": "5.2.3",
        "lessThan": "5.2.7",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
en	www.en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2026-07
github	www.github.com/hallowelt/docker-bluespice-wiki/commit/04b840be565b508f6e741c376970909b69d2a444

Parameter	Position	Path	Description	CWE
token	path	/api/rest/v1/token	The REST API allows any user with read access (including anonymous users) to obtain an application token due to an insecure default configuration in the token authenticator component.	CWE-1188, CWE-269

23 Oct 2026 19:57Current

5.9Medium risk

Vulners AI Score5.9

CVSS 49.3

CVSS 3.19.8

EPSS0.00345