CVE-2026-25716

Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice Extension:BlueSpiceUserManager allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrators. The REST endpoints /bs-usermanager/v1/block/create and...

CVE-2026-25716 BlueSpiceUserManager: Missing authorization in REST endpoints for blocking and unblocking users

Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice Extension:BlueSpiceUserManager allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrators. The REST endpoints /bs-usermanager/v1/block/create and...

CVE-2026-25716

Hallo Welt! GmbH BlueSpice is vulnerable to a Missing Authorization (CWE-862) flaw within the BlueSpiceUserManager extension. The REST endpoints /bs-usermanager/v1/block/create and /bs-usermanager/v1/block/delete fail to verify the permissions of the acting user when calling UserManager::blockUse...

EUVD-2026-108651

Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice Extension:BlueSpiceUserManager allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrators. The REST endpoints /bs-usermanager/v1/block/create and...