External risk intelligence

BlueSpice Wiki Privilege Escalation via Insecure Default Configuration

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-25784

The vulnerable component is a wiki application deployed via container images. Wikis are commonly deployed as public-facing web applications. Because the vulnerability allows unauthorized access via the REST API of this publicly accessible web service, it qualifies as an internet-facing surface.

Privilege Escalation

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a security vulnerability identified in the BlueSpice wiki application, specifically within its container image. The issue stems from an insecure default configuration that, if not properly set, can allow unauthorized users to gain administrative privileges through the application's API.

Allows unauthorized admin access.
Potentially impacts public-facing wikis.
Confirm relevance and exposure to internal wikis.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by leveraging the default misconfiguration of the token authenticator in the BlueSpice wiki container image. By sending a request to the REST API, an unauthenticated user could obtain an application token. This token could then be used to impersonate the internal service user, thereby gaining administrator privileges.

No authentication required.
Triggered via REST API token request.
Risk of full system takeover.

Live Threat

Current exploitation, exposure, and threat context

When the environment variable `WIKI_SERVICE_TOKEN_AUTH_ALLOWED` is not set in the Hallo Welt! GmbH BlueSpice container image, an empty string is used for IP restriction. This condition allows any user with read access to the wiki to obtain an application token via the REST API and impersonate the internal service user with administrative privileges.

Wiki administrative access and user data.
Unauthenticated API token requests.
Unauthorized system control.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams are likely responsible for addressing this critical vulnerability in the BlueSpice container image. The first practical step is to identify all instances of the affected BlueSpice container image, determine their business criticality and network exposure, and locate the accountable owner for each instance before planning remediation.

Confirm application and platform team ownership.
Verify affected container image deployment scope.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is BlueSpice and how is it deployed?

BlueSpice is an enterprise-grade wiki platform built on top of MediaWiki, often used for knowledge management and documentation. Hallo Welt! GmbH provides pre-packaged container images for BlueSpice to simplify deployment in cloud or server environments. These containers include specific configurations and components, such as the token authenticator service, designed to manage how internal services communicate within the wiki infrastructure.

What does CWE-1188 mean for CVE-2026-25784?

CWE-1188 refers to the Initialization of a Resource with an Insecure Default. In this case, the software fails to properly secure a network authentication setting by default. Because the system defaults to an empty value rather than a restrictive one, it inadvertently turns off essential security guardrails, allowing unauthorized users to interact with sensitive API functions that should be restricted to internal services.

How is this privilege escalation triggered?

The vulnerability is triggered by sending a request to the wiki's REST API when the specific environment variable meant to restrict access is unset. This does not trigger if the environment variable is correctly configured to define valid IP ranges. Essentially, the lack of a defined security policy allows the system to accept requests it would otherwise reject, enabling an attacker to acquire tokens intended only for trusted internal components.

Is my wiki at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as an internet-facing risk because BlueSpice wikis are frequently deployed as public-facing web applications. If your instance is reachable from the internet, it provides an exposed path for an attacker to reach the REST API. Even if your wiki is intended for internal use, you should verify if it is accidentally accessible over broader networks or if local users could reach the API.

What are the first steps to address this CVE?

Begin by auditing your environment to locate all running BlueSpice container images. Verify your configuration files to see if the relevant environment variable is missing or improperly set. Coordinate with your platform or infrastructure team to update the container configuration or apply patches provided by the vendor, prioritizing systems that are accessible from untrusted networks.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.