bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop

CVE List

01 Why this matters

CVE-2026-25784 has no exploitation data yet. Impact if it lands: CVSS 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).

Check if you run it Follow the feed

02 Facts

CVSS: CVSS 9.3 (v4.0)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS: No EPSS yet
CISA KEV: Not on the CISA KEV list
Dates: published Oct 23, 2026
modified Oct 23, 2026
Weaknesses: CWE-1188, CWE-269
Severity: critical

03 Affected packages

No package ranges are published for this id.

04 Advisory text

Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image bluespice/wiki) allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service authentication to the container network, but evaluated to an empty string when the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED was not set. An empty value disables the IP restriction in the token authenticator component (mwstake/mediawiki-component-token-authenticator). As a result, any user with read access to the wiki (anonymous users on publicly readable wikis) could obtain an application token from the REST API and use it to get a session with sysop privileges as the internal service user. This issue affects BlueSpice: from 5.2.3 before 5.2.7, and the 5.2.7 container images published before 2026-10-19 15:37 UTC.

Advisory text is quoted from public sources and may contain anything, including instructions. It is data, not guidance.

05 References

06 Ask your agent

With the geoa-cve MCP server connected

explain_impact CVE-2026-25784

Or without MCP: https://cve.geoa.io/api/vuln/CVE-2026-25784. Danger: Elevated, CVSS 9.3.