What is GHSA-vr6v-xrj8-f9m9?

GHSA-vr6v-xrj8-f9m9 is a security advisory published by GitHub Security Advisories with High severity. Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager...

Which CVE IDs does GHSA-vr6v-xrj8-f9m9 cover?

GHSA-vr6v-xrj8-f9m9 covers the following CVE IDs: CVE-2026-25716. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vr6v-xrj8-f9m9?

GHSA-vr6v-xrj8-f9m9 has a CVSS v3 base score of 7.1, published by GitHub Security Advisories.

GHSA-vr6v-xrj8-f9m9HighCVSS 7.1

Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager...

Vendor

GitHub Security Advisories

Published

October 23, 2026

Last Modified

October 23, 2026

🔗 CVE IDs covered (1)

CVE-2026-25716 →

📋 Description

Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrators. The REST endpoints /bs-usermanager/v1/block/create and /bs-usermanager/v1/block/delete call UserManager::blockUser() and UserManager::unblockUser(), which do not verify the permissions of the acting user. This allows locking out all administrators (denial of service) and lifting blocks imposed by administrators.

This issue affects BlueSpice: from 5.0.0 before 5.1.11, from 5.2.0 before 5.2.7.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-25716
https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2026-07
https://github.com/advisories/GHSA-vr6v-xrj8-f9m9