CVE-2026-25784 | Hallo Welt! BlueSpice up to 5.2.6 Token Authenticator LocalSettings.php mwsgTokenAuthenticatorServiceCIDR default permission (EUVD-2026-108653)

October 23, 2026 Yanac

A vulnerability classified as critical was found in Hallo Welt! BlueSpice up to 5.2.6. Impacted is an unknown function of the file LocalSettings.php of the component Token Authenticator. The manipulation of the argument mwsgTokenAuthenticatorServiceCIDR results in incorrect default permissions.

This vulnerability was named CVE-2026-25784. The attack may be performed from remote. There is no available exploit.

Upgrading the affected component is advised.VulDB Recent EntriesRead More