BlueSpice EUVD-2026-108653

Requires the bluespice/wiki container deployed in its default configuration where the WIKI_SERVICE_TOKEN_AUTH_ALLOWED environment variable is unset; this causes $mwsgTokenAuthenticatorServiceCIDR in LocalSettings.php to evaluate to an empty string, which disables the IP restriction in the token authenticator (mwstake/mediawiki-component-token-authenticator) so internal service token authentication is accepted from any address. The attacker must have read access to the wiki to call the REST API - this means fully unauthenticated (anonymous) only on publicly readable wikis; on access-controlled wikis a low-privileged read account is needed. Exploitation is limited to affected builds: BlueSpice 5.2.3 through 5.2.6, and 5.2.7 container images published before 2026-10-19 15:37 UTC. Setting WIKI_SERVICE_TOKEN_AUTH_ALLOWED to a proper CIDR, or updating to a fixed image, removes the condition.

All signals point in the same direction: this is a genuine high-priority issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) describes a network-reachable, low-complexity flaw that, on a publicly readable wiki, requires no authentication and yields full confidentiality, integrity and availability loss via sysop takeover. The vuln.today decision label is act_now and the vendor has shipped a patch, reinforcing urgency. The root cause is confirmed by the source diff: the default used '??' (null-coalescing), which does not fall back on an empty string, so $mwsgTokenAuthenticatorServiceCIDR stayed empty and the token authenticator's IP restriction was silently disabled - the fix changes it to '?:' (which also falls back on empty/falsy values). No EPSS score was provided and the CVE is NOT in CISA KEV, so there is no data indicating active exploitation; likewise no public exploit or PoC reference is supplied, so this should be treated as no public exploit identified at time of analysis rather than a known-exploited bug. The main factor that moderates raw severity is scope of impact: exploitation is confined to the affected default-configuration container images and to attackers who have at least read access to the wiki (anonymous only where the wiki is publicly readable). On such public, default-config deployments the barrier is effectively nil, so the high CVSS is justified rather than inflated.

An attacker with read access to an affected BlueSpice container wiki - an anonymous visitor if the wiki is publicly readable - calls the REST API to obtain an application token, then redeems that token for a session that authenticates as the internal service user with sysop privileges, giving full administrative control of the wiki. Because the default container left the token authenticator's IP restriction disabled, the request succeeds from any source address. No public proof-of-concept exploit has been published, but the trigger is straightforward given network access and the low attack complexity.