CERT24CVE-2026-25784 — insecure default configuration of service-token authentication in the bluespice/wiki container allows privilege escalationLoading data…
CERT24Threat Observatory
Period

CVE-2026-25784 — insecure default configuration of service-token authentication in the bluespice/wiki container allows privilege escalation

A default configuration in the BlueSpice container may allow privilege escalation. When WIKI_SERVICE_TOKEN_AUTH_ALLOWED is not set, $mwsgTokenAuthenticatorServiceCIDR evaluates to an empty string, disabling the IP restriction in the token-authenticator component.

← Back to intelligence

CVE-2026-25784 — insecure default configuration of service-token authentication in the bluespice/wiki container allows privilege escalation

A default configuration in the BlueSpice container may allow privilege escalation. When WIKI_SERVICE_TOKEN_AUTH_ALLOWED is not set, $mwsgTokenAuthenticatorServiceCIDR evaluates to an empty string, disabling the IP restriction in the token-authenticator component.