bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop
Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED was not set. An empty value disables the IP restriction in the token authenticator component (mwstake/mediawiki-component-token-authenticator). As a result, any user with read access to the wiki (anonymous users on publicly readable wikis) could obtain an application token from the REST API and use it to get a session with sysop privileges as the internal service user. This issue affects BlueSpice: from 5.2.3 before 5.2.7, and the 5.2.7 container images published before 2026-10-19 15:37 UTC.
CVE-2026-25784
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-25784
BlueSpice
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/hallowelt/docker-bluespice-wiki",
"vendor": "Hallo Welt! GmbH",
"modules": [
"Container bluespice/wiki"
],
"product": "BlueSpice",
"versions": [
{
"status": "affected",
"version": "5.2.3",
"lessThan": "5.2.7",
"versionType": "semver"
}
],
"packageName": "bluespice/wiki",
"programFiles": [
"root-fs/app/conf/LocalSettings.php"
],
"collectionURL": "https://hub.docker.com/r/bluespice/wiki",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-25784
Source reference:
/cveMetadata/cveId
Publisher severity
critical
Source reference: /containers/cna/metrics
- Event
- #52628 · Revision 1
- Added to Heist Feed
- Publisher date