An insecure default configuration in BlueSpice's Wiki container allows any user with read access to a wiki to obtain an application token from the REST API. Because the environment variable controlling the IP restriction is unset, the service token authenticator disables the intended network restriction, permitting the token to be used to create a session as the internal service user with sysop rights. This privilege escalation can lead to full control over the wiki, including editing, uploading, and potentially malicious configuration changes.

Products affected are BlueSpice container images distributed under the name bluespice/wiki. The vulnerability exists in versions 5.2.3 up to, but not including, 5.2.7, as well as in 5.2.7 container images that were published before 2026‑10‑19 15:37 UTC. The vendor is Hallo Welt! GmbH. All deployments using these images without the remedial environment setting are impacted.

The CVSS score of 9.3 indicates a high‑severity flaw. With no EPSS score available and the vulnerability not yet listed in CISA KEV, the likelihood of exploitation remains uncertain, but the attack path is straightforward: a publicly readable wiki host allows any internet user to call the token generation API and elevate privileges. The environment variable override and reverse‑proxy restriction provide temporary mitigation until an official image update can be applied.