CVE-2026-25784: Critical severity Hallo Welt! GmbH BlueSpice vulnerability
Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the environment variable WIKISERVICETOKENAUTHALLOWED was not set. An empty value disables the IP restriction in the token authenticator component (mwstake/mediawiki-component-token-authenticator). As a result, any user with read access to the wiki (anonymous users on publicly readable wikis) could obtain an application token from the REST API and use it to get a session with sysop privileges as the internal service user.
This issue affects BlueSpice: from 5.2.3 before 5.2.7, and the 5.2.7 container images published before 2026-10-19 15:37 UTC.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bluespice/wikito a version that resolves this vulnerability.Fixed in 5.2.7 - Operational
For container images of BlueSpice 5.2.7 pulled before 2026-10-19 15:37 UTC, pull the images again and re-create the containers.
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated exploitation?
Publicly readable BlueSpice wikis are exposed because anonymous users have the required read access. Any user with read access can obtain an application token through the REST API and use it to create a sysop-privileged session as the internal service user.
What configuration causes the IP restriction to be disabled?
The issue occurs when WIKI_SERVICE_TOKEN_AUTH_ALLOWED is not set. In affected container images, this causes $mwsgTokenAuthenticatorServiceCIDR in LocalSettings.php to evaluate to an empty string, which disables the token authenticator's IP restriction.
Which versions and container images are affected?
Affected releases are BlueSpice 5.2.3 through versions before 5.2.7. BlueSpice 5.2.7 container images published before 2026-10-19 15:37 UTC are also affected.
What temporary mitigation is indicated if an image cannot be updated immediately?
Set WIKI_SERVICE_TOKEN_AUTH_ALLOWED so that $mwsgTokenAuthenticatorServiceCIDR does not remain empty and restricts internal service authentication to the intended container network. The provided data does not specify a particular CIDR value.