Medium severity · published Mar 4, 2026
CVE-2026-24732
Improper permission checks in Extension:NSFileRepo
6.6
CVSS
0.3%
EPSS
No
On KEV
Description
Files or Directories Accessible to External Parties, Incorrect Permission Assignment for Critical Resource vulnerability in Hallo Welt! GmbH BlueSpice (Extension:NSFileRepo modules) allows Accessing Functionality Not Properly Constrained by ACLs, Bypassing Electronic Locks and Access Controls.This issue affects BlueSpice: from 5.1 through 5.1.3, from 5.2 through 5.2.0.
HINT: Versions provided apply to BlueSpice MediaWiki releases. For Extension:NSFileRepo the affected versions are 3.0 < 3.0.5
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BL
BlueSpice · Hallo Welt! GmbH
5.1 through 5.1.3; 5.2 through 5.2.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-24732
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-24732
en.wiki.bluespice.com
https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2026-02
More from BlueSpice
9.8
CVE-2026-25784
bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop
7.1
CVE-2026-25716
BlueSpiceUserManager: Missing authorization in REST endpoints for blocking and unblocking users
6.4
CVE-2025-48007
Potential XSS in Extension:BlueSpiceAvatars
6.4
CVE-2025-46703
Potential XSS in Extension:AtMentions
5.4
CVE-2025-57880
Potential XSS in Extension:BlueSpiceWhoIsOnline