{"schema":"threatline.record/2","record":{"id":"CVE-2026-25716","aliases":[],"summary":"BlueSpiceUserManager: Missing authorization in REST endpoints for blocking and unblocking users","details":"Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrators. The REST endpoints /bs-usermanager/v1/block/create and /bs-usermanager/v1/block/delete call UserManager::blockUser() and UserManager::unblockUser(), which do not verify the permissions of the acting user. This allows locking out all administrators (denial of service) and lifting blocks imposed by administrators.\n\nThis issue affects BlueSpice: from 5.0.0 before 5.1.11, from 5.2.0 before 5.2.7.","categories":["Unclassified"],"product":"BlueSpice","vendor":"Hallo Welt! GmbH","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-25716","source_modified_at":"2026-10-23T08:56:11.231Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"BlueSpice","vendor":"Hallo Welt! GmbH","versions":[{"status":"affected","version":"5.0.0","lessThan":"5.1.11","versionType":"semver"},{"status":"affected","version":"5.2.0","lessThan":"5.2.7","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-25716","source_modified_at":"2026-10-23T08:56:11.231Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"BlueSpice","ecosystem":null},"version":"5.1.11","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-25716","source_modified_at":"2026-10-23T08:56:11.231Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"BlueSpice","ecosystem":null},"version":"5.2.7","basis":"first unaffected version stated in the CVE record"}],"cvss":7.1,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00183,"percentile":0.07504,"score_date":"2026-10-23"},"published_at":"2026-10-23T08:53:47.208Z","modified_at":"2026-10-23T08:56:11.231Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-25716","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T08:56:11.231Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-25716","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2026-07","tags":["vendor-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-23T08:56:11.231Z","content_hash":"c4440789198e6b4e8e6913f9ad4dce8ad807e342bdd361af16b5716a1725573d"}}