CVE-2026-25784: CWE-1188 Initialization of a Resource with an Insecure Default in Hallo Welt! GmbH BlueSpice

The vulnerability stems from the $mwsgTokenAuthenticatorServiceCIDR variable in BlueSpice's LocalSettings.php defaulting to an empty string when the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED is not set. This empty value disables IP-based restrictions in the token authenticator component (mwstake/mediawiki-component-token-authenticator). Consequently, unauthorized users with read access can acquire an application token from the REST API and use it to gain a session with sysop privileges as the internal service user. The issue affects BlueSpice container images from version 5.2.3 up to but not including 5.2.7, including 5.2.7 images published before 2026-10-19 15:37 UTC.

An attacker with read access to the wiki, including anonymous users on publicly readable wikis, can escalate privileges to sysop level by obtaining an application token through the REST API. This results in a complete compromise of administrative privileges within the affected BlueSpice instances.

A fix is available in BlueSpice versions 5.2.7 published after 2026-10-19 15:37 UTC and later. Users should upgrade to these fixed versions to remediate the vulnerability. Until then, ensure the environment variable WIKI_SERVICE_TOKEN_AUTH_ALLOWED is properly set to restrict internal service authentication to the container network, or apply the official patch once available.