CVE-2026-25716: BlueSpiceUserManager: Missing authorization in REST endpoints for blocking and unblocking users
Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrators. The REST endpoints /bs-usermanager/v1/block/create and /bs-usermanager/v1/block/delete call UserManager::blockUser() and UserManager::unblockUser(), which do not verify the permissions of the acting user. This allows locking out all administrators (denial of service) and lifting blocks imposed by administrators.
This issue affects BlueSpice: from 5.0.0 before 5.1.11, from 5.2.0 before 5.2.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BlueSpiceto a version that resolves this vulnerability.Fixed in 5.1.11 - Upgrade
Upgrade
BlueSpiceto a version that resolves this vulnerability.Fixed in 5.2.7
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user can exploit it; no special privileges are required. The affected endpoints allow that user to block or unblock arbitrary accounts, including administrator accounts.
What is the likely operational impact?
An attacker can block all administrator accounts, causing a denial of service for administrative access. They can also remove blocks that administrators previously imposed on users.
Which deployments are affected?
Affected versions are BlueSpice 5.0.0 through before 5.1.11, and 5.2.0 through before 5.2.7. Deployments outside those stated version ranges are not identified as affected by the provided information.
How can I check whether my instance is exposed?
Check the installed BlueSpice version against the affected ranges and review whether authenticated users can reach /bs-usermanager/v1/block/create or /bs-usermanager/v1/block/delete. Review account block and unblock activity for unexpected changes, especially actions affecting administrator accounts.