The vulnerability in the BlueSpice UserManager extension allows an authenticated user who does not have special privileges to invoke REST endpoints that block or unblock any user account. Because the UserManager::blockUser() and UserManager::unblockUser() functions do not check the caller’s permissions, an attacker could lock out all administrators, effectively disabling administrative access, or could lift blocks that administrators had placed, causing a denial of service for protected accounts and allowing attackers to further exploit compromised or sensitive accounts.

All installations of BlueSpice from version 5.0.0 through the release just before 5.1.11 and from 5.2.0 through the release just before 5.2.7 are affected. These include every instance that uses the BlueSpice UserManager extension within those version ranges.

The CVSS score of 7.1 classifies this flaw as high severity. Because the EPSS score is not available, the empirical probability of exploitation is unknown, but the flaw is listed in no KEV catalog. The likely attack vector requires the attacker to be authenticated, yet no special privileges are necessary; any user with basic access can trigger the abuse. The absence of permission checks means that once compromised, an attacker can create or delete blocks on any account, resulting in significant integrity and availability impacts for administrators and other protected users.