CERT24CVE-2026-25716 — Missing authorization in BlueSpiceUserManager REST endpoints for blocking and unblocking usersLoading data…
CERT24Threat Observatory
Period

CVE-2026-25716 — Missing authorization in BlueSpiceUserManager REST endpoints for blocking and unblocking users

A missing-authorization issue in the BlueSpiceUserManager extension for BlueSpice allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrator accounts.

← Back to intelligence

CVE-2026-25716 — Missing authorization in BlueSpiceUserManager REST endpoints for blocking and unblocking users

A missing-authorization issue in the BlueSpiceUserManager extension for BlueSpice allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrator accounts.