An improper permission check in the BlueSpice Extension:NSFileRepo module allows attackers to retrieve or modify files and directories that should be restricted, effectively bypassing the system's access control lists. The flaw aligns with CWE-552, where files or directories become accessible to external parties, and CWE-732, indicating incorrect permission assignments. An attacker who can exploit this vulnerability could read sensitive configuration data, upload malicious files, or alter the content of shared repositories, thereby compromising both confidentiality and integrity of the system.

The vulnerability affects Hallo Welt! GmbH BlueSpice MediaWiki releases from version 5.1 through 5.1.3 and from 5.2 through 5.2.0. For the Extension:NSFileRepo module, the affected releases are 3.0 up to but not including 3.0.5.

With a CVSS score of 6.6, the issue presents a moderate severity. The EPSS score is less than 1%, indicating a very low exploitation probability at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote exploitation via the web interface, where an unauthenticated or low‑privileged user can trigger the faulty file access logic. Despite the low probability of exploitation, the potential impact on sensitive data warrants proactive remediation.