PatchSiren

Hallo Welt! GmbH CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH Hallo Welt! GmbH CVE published 2026-10-23

CVE-2026-25716

A missing authorization vulnerability in BlueSpiceUserManager allows any authenticated user to block or unblock arbitrary user accounts, including administrators, via REST endpoints. This issue affects BlueSpice: from 5.0.0 before 5.1.11, from 5.2.0 before 5.2.7. The vulnerability allows locking out all administrators (denial of service) and lifting blocks imposed by administrators. Defenders should prior [truncated]