BlueSpice Helpdesk - Recent changes [en]

Setup:Release Notes

Vhoesl1 — Wed, 11 Nov 2026 15:18:50 GMT

← Older revision		Revision as of 15:18, 11 November 2026
(One intermediate revision by the same user not shown)
Line 38:		Line 38:
	*'''bluespice/wiki - WebAuthn with smartphone is broken on bluespice/wiki''' (ERM50395)		*'''bluespice/wiki - WebAuthn with smartphone is broken on bluespice/wiki''' (ERM50395)
	:The login via web authentication is possible again.		:The login via web authentication is possible again.
	* '''ContentDroplets - Syntax error in <code>Template:Texbox</code>''' (ERM49140)
	~~: The syntax error in <code>Template:Textbox</code> has been fixed. To use the updated version of the template, it must be manually synchronized via <code>Special:Content_provisioning</code>.~~
	* '''ContentDroplets - Inconsistent capitalization for some content droplets''' (ERM49521)		* '''ContentDroplets - Inconsistent capitalization for some content droplets''' (ERM49521)
	: A consistent capitalization scheme for the droplets was reviewed and revised.		: A consistent capitalization scheme for the droplets was reviewed and revised.
Line 66:		Line 64:

	==== Notable changes ====		==== Notable changes ====
			* '''CognitiveProcessDesigner - The default template <code>Template:CPD/BlankDescription</code> is missing''' (ERM49394)
			: The default template <code>Template:CPD/BlankDescription</code> is now available again. If the provided default template is used, it will be updated automatically. If the template has been modified, it must be manually synchronized via <code>Special:Content_provisioning</code>.
			* '''ContentDroplets - Syntax error in <code>Template:Texbox</code>''' (ERM49140)
			: The syntax error in <code>Template:Textbox</code> has been fixed. If the provided default template is used, it will be updated automatically. If the template has been modified, it must be manually synchronized via <code>Special:Content_provisioning</code>.
	*'''ContentStabilization - The page property <code>QM/Document state</code> should remain “approved” if an implicit draft exists''' (ERM49713)		*'''ContentStabilization - The page property <code>QM/Document state</code> should remain “approved” if an implicit draft exists''' (ERM49713)
	:If a change to a resource creates an implicit draft for a page, the page property <code>QM/Document state</code> remains in status <code>Approved</code>, since the content of the page has not actually changed.		:If a change to a resource creates an implicit draft for a page, the page property <code>QM/Document state</code> remains in status <code>Approved</code>, since the content of the page has not actually changed.
Line 86:		Line 88:
	* '''CommentStreams - Incorrect timestamp is displayed in the comments section''' (ERM49281)		* '''CommentStreams - Incorrect timestamp is displayed in the comments section''' (ERM49281)
	: The timestamps for the comments are now displayed correctly again.		: The timestamps for the comments are now displayed correctly again.
	* '''CognitiveProcessDesigner - The default template <code>Template:CPD/BlankDescription</code> is missing''' (ERM49394)
	: The default template <code>Template:CPD/BlankDescription</code> is now available again. Please note that this requires a sync on <code>Special:Content_provisioning</code> for <code>Template:CPD/BlankDescription</code> so that it is present in the wiki.
	* '''CommentStreams - Deleting comments from other users does not work for custom groups with admin permissions''' (ERM50072)		* '''CommentStreams - Deleting comments from other users does not work for custom groups with admin permissions''' (ERM50072)
	: Deleting comments posted by other users now works for both the built-in admin group and custom groups with admin permissions.		: Deleting comments posted by other users now works for both the built-in admin group and custom groups with admin permissions.
Line 146:		Line 146:
	*'''bluespice/wiki - WebAuthn with smartphone is broken on bluespice/wiki''' (ERM50395)		*'''bluespice/wiki - WebAuthn with smartphone is broken on bluespice/wiki''' (ERM50395)
	:The login via web authentication is possible again.		:The login via web authentication is possible again.
	* '''ContentDroplets - Syntax error in <code>Template:Texbox</code>''' (ERM49140)
	~~: The syntax error in <code>Template:Textbox</code> has been fixed. To use the updated version of the template, it must be manually synchronized via <code>Special:Content_provisioning</code>.~~
	* '''ContentDroplets - Inconsistent capitalization for some content droplets''' (ERM49521)		* '''ContentDroplets - Inconsistent capitalization for some content droplets''' (ERM49521)
	: A consistent capitalization scheme for the droplets was reviewed and revised.		: A consistent capitalization scheme for the droplets was reviewed and revised.
Line 174:		Line 172:

	==== Notable changes ====		==== Notable changes ====
			* '''CognitiveProcessDesigner - The default template <code>Template:CPD/BlankDescription</code> is missing''' (ERM49394)
			: The default template <code>Template:CPD/BlankDescription</code> is now available again. If the provided default template is used, it will be updated automatically. If the template has been modified, it must be manually synchronized via <code>Special:Content_provisioning</code>.
			* '''ContentDroplets - Syntax error in <code>Template:Texbox</code>''' (ERM49140)
			: The syntax error in <code>Template:Textbox</code> has been fixed. If the provided default template is used, it will be updated automatically. If the template has been modified, it must be manually synchronized via <code>Special:Content_provisioning</code>.
	*'''ContentStabilization - The page property <code>QM/Document state</code> should remain “approved” if an implicit draft exists''' (ERM49713)		*'''ContentStabilization - The page property <code>QM/Document state</code> should remain “approved” if an implicit draft exists''' (ERM49713)
	:If a change to a resource creates an implicit draft for a page, the page property <code>QM/Document state</code> remains in status <code>Approved</code>, since the content of the page has not actually changed.		:If a change to a resource creates an implicit draft for a page, the page property <code>QM/Document state</code> remains in status <code>Approved</code>, since the content of the page has not actually changed.
Line 193:		Line 195:
	* '''CommentStreams - Incorrect timestamp is displayed in the comments section''' (ERM49281)		* '''CommentStreams - Incorrect timestamp is displayed in the comments section''' (ERM49281)
	: The timestamps for the comments are now displayed correctly again.		: The timestamps for the comments are now displayed correctly again.
	* '''CognitiveProcessDesigner - The default template <code>Template:CPD/BlankDescription</code> is missing''' (ERM49394)
	: The default template <code>Template:CPD/BlankDescription</code> is now available again. Please note that this requires a sync on <code>Special:Content_provisioning</code> for <code>Template:CPD/BlankDescription</code> so that it is present in the wiki.
	* '''CommentStreams - Deleting comments from other users does not work for custom groups with admin permissions''' (ERM50072)		* '''CommentStreams - Deleting comments from other users does not work for custom groups with admin permissions''' (ERM50072)
	: Deleting comments posted by other users now works for both the built-in admin group and custom groups with admin permissions.		: Deleting comments posted by other users now works for both the built-in admin group and custom groups with admin permissions.

Manual:Extension/Workflows/Activities/GroupVote

Bhuber — Mon, 09 Nov 2026 11:00:46 GMT

← Older revision		Revision as of 11:00, 9 November 2026
Line 1:		Line 1:
	==Description==		==Description==
	The activity ''GroupVot''e is responsible for collecting necessary data about the voting of a group on a special topic. Unlike the [[Manual:Extension/Workflows/~~Activity~~/UserVote\|UserVote]], it is not possbile to delegate the task. A user that is part of a group can accept or decline a vote and also leave a comment that justifies their decision. The voting result is determined by whatever threshold has been reached first and ends the activity.		The activity ''GroupVot''e is responsible for collecting necessary data about the voting of a group on a special topic. Unlike the [[Manual:Extension/Workflows/Activities/UserVote\|UserVote]], it is not possbile to delegate the task. A user that is part of a group can accept or decline a vote and also leave a comment that justifies their decision. The voting result is determined by whatever threshold has been reached first and ends the activity.
	{\| class="wikitable"		{\| class="wikitable"
	! colspan="2" \|'''Short profile'''		! colspan="2" \|'''Short profile'''

Reference:PreToClip

Margit.link-rodrigue — Fri, 06 Nov 2026 10:11:10 GMT

← Older revision		Revision as of 10:11, 6 November 2026
(One intermediate revision by the same user not shown)
Line 8:		Line 8:
	\|category=Content Structuring		\|category=Content Structuring
	\|docu=https://www.mediawiki.org/wiki/Extension:PreToClip		\|docu=https://www.mediawiki.org/wiki/Extension:PreToClip
	\|features=The '''PreToClip''' extension adds a "Copy to clipboard" button to every <code><nowiki>~~�0�~~</nowiki></code> ~~tags can be generated with the [[Manual:Extension/ContentDroplets{{!}}ContentDroplet]] ''Code''~~.		\|features=The '''PreToClip''' extension adds a "Copy to clipboard" button to every <code><nowiki>pre</nowiki></code> tag.

	[[File:Extension_PreToClip.png{{!}}alt=PreToClip "Copy" button{{!}}center{{!}}thumb{{!}}344x344px{{!}}PreToClip "Copy" button]]		[[File:Extension_PreToClip.png{{!}}alt=PreToClip "Copy" button{{!}}center{{!}}thumb{{!}}344x344px{{!}}PreToClip "Copy" button]]

Security:Security Advisories/BSSA-2026-09

Rvogel1 — Fri, 06 Nov 2026 07:02:58 GMT

← Older revision		Revision as of 07:02, 6 November 2026
Line 1:		Line 1:
	~~'''~~Update 2026-11-~~05:'''~~ This advisory was corrected:		{{Textbox\|boxtype=important\|icon=yes\|header=Update 2026-11-06\|text=This advisory was corrected and extended:
	* Not all containers were rebuilt for BlueSpice 5.1.11.2 and 5.2.7.2 on 2026-10-30. The rebuilt images of ~~<code>chat</code>,~~ <code>wire</code>, <code>formula</code>, <code>pdf</code>, <code>diagram</code>, <code>frontendcache</code> and <code>kerberosproxy</code> were published on 2026-11-04. <code>collabpads</code>, <code>proxy</code> and <code>database</code> have not been rebuilt yet. Their risk stays '''low'''. See "Fixed in" and "Solution".		* Not all containers were rebuilt for BlueSpice 5.1.11.2 and 5.2.7.2 on 2026-10-30. The rebuilt images of <code>wire</code>, <code>formula</code>, <code>pdf</code>, <code>diagram</code>, <code>frontendcache</code> and <code>kerberosproxy</code> were published on 2026-11-04. <code>collabpads</code>, <code>proxy</code> and <code>database</code> have not been rebuilt yet. Their risk stays '''low'''. See "Fixed in" and "Solution".
	* New section on Ghostscript (container <code>bluespice/wiki</code>, all editions): Ghostscript contains its own copy of the Brotli library. According to our analysis, this copy already contains the fix. Security scanners may still report it. As a precaution, we recommend disabling the extension PdfHandler. Risk: '''low'''. See [[#Precaution: disable PdfHandler (all editions)\|below]].		* New section on Ghostscript (container <code>bluespice/wiki</code>, all editions): Ghostscript contains its own copy of the Brotli library. According to our analysis, this copy already contains the fix. Security scanners may still report it. As a precaution, we recommend disabling the extension PdfHandler. Risk: '''low'''. See [[#Precaution: disable PdfHandler (all editions)\|below]].
			* CVE-2026-115557: the container <code>bluespice/ai</code> is now also fixed in BlueSpice 5.2.7.2 (published on 2026-11-06), earlier than announced (5.2.8). After the update, the AI service no longer needs to be disabled.
			}}

	{\| class="wikitable"		{\| class="wikitable"
Line 9:		Line 11:
	\|-		\|-
	\|Date		\|Date
	\|2026-10-29 (updated 2026-11-05)		\|2026-10-29 (updated 2026-11-06)
	\|-		\|-
	\|Severity		\|Severity
Line 21:		Line 23:
	* All other containers, including <code>bluespice/wiki</code> in BlueSpice free, contain the affected library, but are not exploitable in default configuration		* All other containers, including <code>bluespice/wiki</code> in BlueSpice free, contain the affected library, but are not exploitable in default configuration
	* Ghostscript in container <code>bluespice/wiki</code> (all editions, all versions up to 5.1.11.2 and 5.2.7.2): own copy of the Brotli library, which most likely already contains the fix (precaution)		* Ghostscript in container <code>bluespice/wiki</code> (all editions, all versions up to 5.1.11.2 and 5.2.7.2): own copy of the Brotli library, which most likely already contains the fix (precaution)
	* CVE-2026-115557: Container <code>bluespice/ai</code> in BlueSpice 5.2 ~~before~~ 5.2.8, if the AI service is used		* CVE-2026-115557: Container <code>bluespice/ai</code> in BlueSpice 5.2 up to 5.2.7.1, if the AI service is used
	* CVE-2026-115557 (same issue in Node.js, no own CVE): Container <code>bluespice/chat</code> in BlueSpice 5.2 up to 5.2.7.1, if the chat service is used		* CVE-2026-115557 (same issue in Node.js, no own CVE): Container <code>bluespice/chat</code> in BlueSpice 5.2 up to 5.2.7.1, if the chat service is used
	\|-		\|-
Line 27:		Line 29:
	\|		\|
	* BlueSpice 5.1.11.2 and BlueSpice 5.2.7.2:		* BlueSpice 5.1.11.2 and BlueSpice 5.2.7.2:
	** ~~container~~ <code>bluespice/wiki</code> (all editions): published on 2026-10-30		** containers <code>bluespice/wiki</code> (all editions) and <code>chat</code> (5.2 only): published on 2026-10-30
	** containers ~~<code>chat</code> and~~ <code>wire</code> (5.2 only), <code>formula</code>, <code>pdf</code>, <code>diagram</code>, <code>kerberosproxy</code> (5.1 and 5.2) and <code>frontendcache</code> (5.2): published on 2026-11-04		** containers <code>wire</code> (5.2 only), <code>formula</code>, <code>pdf</code>, <code>diagram</code>, <code>kerberosproxy</code> (5.1 and 5.2) and <code>frontendcache</code> (5.2): published on 2026-11-04
	** <!-- TODO: update when rebuilt --> containers <code>collabpads</code>, <code>proxy</code> and <code>database</code>: not rebuilt yet (risk: low)		** <!-- TODO: update when rebuilt --> containers <code>collabpads</code>, <code>proxy</code> and <code>database</code>: not rebuilt yet (risk: low)
	** Ghostscript in container <code>bluespice/wiki</code>: no update available; precaution see below		** Ghostscript in container <code>bluespice/wiki</code>: no update available; precaution see below
	* CVE-2026-115557: BlueSpice 5.2.7.2 (container <code>bluespice/chat</code>); ~~BlueSpice 5.2.8 (~~container <code>bluespice/ai</code>~~, next regular release~~)		* CVE-2026-115557: BlueSpice 5.2.7.2 (container <code>bluespice/chat</code>: published on 2026-10-30; container <code>bluespice/ai</code>: published on 2026-11-06)
	\|-		\|-
	\|CVE		\|CVE
Line 112:		Line 114:
	\| style="vertical-align:middle;text-align:left;" \|Container <code>bluespice/ai</code> (CVE-2026-115557)		\| style="vertical-align:middle;text-align:left;" \|Container <code>bluespice/ai</code> (CVE-2026-115557)
	\| style="vertical-align:middle;text-align:left;" class="col-orange-bg" \|'''Medium'''. The AI service is not part of standard installations. It sends questions, wiki content and the API key of the AI provider (e.g. Azure OpenAI, OpenAI, Google, IONOS) over encrypted connections. It still accepts the forged certificates. An attacker who can intercept and redirect the network traffic between your server and the AI provider can read the API key and the wiki content and change the answers. Access to the wiki is not required. However, the attacker must control the network path, e.g. a router, DNS or proxy server between your server and the AI provider. This makes an attack difficult. We do not know of any attacks.		\| style="vertical-align:middle;text-align:left;" class="col-orange-bg" \|'''Medium'''. The AI service is not part of standard installations. It sends questions, wiki content and the API key of the AI provider (e.g. Azure OpenAI, OpenAI, Google, IONOS) over encrypted connections. It still accepts the forged certificates. An attacker who can intercept and redirect the network traffic between your server and the AI provider can read the API key and the wiki content and change the answers. Access to the wiki is not required. However, the attacker must control the network path, e.g. a router, DNS or proxy server between your server and the AI provider. This makes an attack difficult. We do not know of any attacks.
	\| style="vertical-align:middle;text-align:left;" \|~~Disable the AI service until~~ BlueSpice 5.2.8: set <code>AI=false</code> in the <code>.env</code> file and run <code>./bluespice-deploy up -d --remove-orphans</code>. The AI features of the wiki and the chat are not available until then.		\| style="vertical-align:middle;text-align:left;" \|Update to BlueSpice 5.2.7.2. If you cannot update, disable the AI service: set <code>AI=false</code> in the <code>.env</code> file and run <code>./bluespice-deploy up -d --remove-orphans</code>. The AI features of the wiki and the chat are not available until then.
	\|-		\|-
	\| style="vertical-align:middle;text-align:left;" \|Container <code>bluespice/chat</code> (CVE-2026-115557, same issue in Node.js)		\| style="vertical-align:middle;text-align:left;" \|Container <code>bluespice/chat</code> (CVE-2026-115557, same issue in Node.js)
Line 131:		Line 133:
	* <code>./bluespice-deploy exec wiki-web apk info -v brotli-libs</code> and <code>./bluespice-deploy exec wiki-task apk info -v brotli-libs</code>: must show <code>brotli-libs-1.2.1-r0</code> or higher		* <code>./bluespice-deploy exec wiki-web apk info -v brotli-libs</code> and <code>./bluespice-deploy exec wiki-task apk info -v brotli-libs</code>: must show <code>brotli-libs-1.2.1-r0</code> or higher
	* <code>./bluespice-deploy exec chat node -v</code> (BlueSpice 5.2, only if the chat service is used): must show <code>v24.22.1</code> or higher		* <code>./bluespice-deploy exec chat node -v</code> (BlueSpice 5.2, only if the chat service is used): must show <code>v24.22.1</code> or higher
			* <code>./bluespice-deploy exec ai python3 -V</code> (BlueSpice 5.2, only if the AI service is used): must show <code>Python 3.12.16</code> or higher

	The ~~container~~ <code>bluespice/ai</code> was ~~'''not''' rebuilt for BlueSpice~~ 5.2.7.2. ~~It will be fixed in BlueSpice 5.2.8. Until then~~, ~~disable~~ the AI ~~service as described~~ in the ~~table above~~, ~~if you use it~~.		The fixed image of <code>bluespice/ai</code> was published on 2026-11-06. If you have already updated to 5.2.7.2 before that date and use the AI service, run the update commands again. If you disabled the AI service because of this advisory, you can enable it again after the update (<code>AI=true</code> in the <code>.env</code> file, then <code>./bluespice-deploy up -d</code>).

	=== Mitigation without update: disable ExternalData and ExternalContent (BlueSpice pro and farm) ===		=== Mitigation without update: disable ExternalData and ExternalContent (BlueSpice pro and farm) ===
Line 148:		Line 151:
	# same for wiki-task and wiki-installer		# same for wiki-task and wiki-installer
	</syntaxhighlight>		</syntaxhighlight>
	Then re-create the containers with <code>./bluespice-deploy up -d</code>. The copied file belongs to the current version. ~~'''~~Remove the mount before or together with the update.~~'''~~		Then re-create the containers with <code>./bluespice-deploy up -d</code>. The copied file belongs to the current version.
			{{Textbox\|boxtype=warning\|icon=yes\|header=Remove the mount when you update\|text=Remove the mount before or together with the update. Otherwise the copied file of the old version replaces the file of the new version.}}

	While the extensions are disabled, pages that use them show the parser functions as plain text or no data. No content is lost.		While the extensions are disabled, pages that use them show the parser functions as plain text or no data. No content is lost.
Line 169:		Line 173:
	# same for wiki-task and wiki-installer		# same for wiki-task and wiki-installer
	</syntaxhighlight>		</syntaxhighlight>
	If you also disable ExternalData and ExternalContent, add both files to the <code>volumes</code> list. Then re-create the containers with <code>./bluespice-deploy up -d</code>. The copied file belongs to the current version. ~~'''~~Remove the mount before or together with the next update.~~''' We will announce here when an updated Ghostscript is available~~.		If you also disable ExternalData and ExternalContent, add both files to the <code>volumes</code> list. Then re-create the containers with <code>./bluespice-deploy up -d</code>. The copied file belongs to the current version. We will announce here when an updated Ghostscript is available.
			{{Textbox\|boxtype=warning\|icon=yes\|header=Remove the mount when you update\|text=Remove the mount before or together with the next update. Otherwise the copied file of the old version replaces the file of the new version.}}

	While PdfHandler is disabled, PDF files can still be uploaded and downloaded. The wiki does not create new preview images for them and shows a file icon instead. No content is lost.		While PdfHandler is disabled, PDF files can still be uploaded and downloaded. The wiki does not create new preview images for them and shows a file icon instead. No content is lost.
Line 186:		Line 191:
	<!-- TODO: Operations to confirm status of the cloud instances before publishing -->		<!-- TODO: Operations to confirm status of the cloud instances before publishing -->
	<!-- TODO (2026-11-05): Operations to confirm whether PdfHandler is disabled in the cloud as a precaution -->		<!-- TODO (2026-11-05): Operations to confirm whether PdfHandler is disabled in the cloud as a precaution -->
	BlueSpice cloud uses the same containers and will be updated by Hallo Welt! GmbH, including the AI service. No action is required from cloud customers.⏎		BlueSpice cloud uses the same containers and will be updated by Hallo Welt! GmbH, including the AI service. No action is required from cloud customers.

Manual:Extension/BlueSpicePermissionManager2

Margit.link-rodrigue — Thu, 05 Nov 2026 16:03:02 GMT

Created page with "{{DISPLAYTITLE:Permissions management}} ==Settings== The permission manager can be accessed from the ''Global actions'' menu ''under Administration > Permissions''. This link loads the page ''Special:PermissionManager.'' There are four different permission settings. The default setting is "Private wiki". If you want to grant different permissions in different namespaces, the setting "Custom setup" is required. File:Manua..."

New page

{{DISPLAYTITLE:Permissions management}}
==Settings==
The permission manager can be accessed from the ''Global actions'' menu ''under Administration > Permissions''. This link loads the page ''Special:PermissionManager.''

There are four different permission settings. The default setting is "Private wiki". If you want to grant different permissions in different [[Manual:Extension/BlueSpiceNamespaceManager|namespaces]], the setting "Custom setup" is required.

[[File:Manual:permissionmanager.png|alt=Permissions with selected setting "Custom setup"|center|thumb|650x650px|Permissions manager]]

An administrator can choose between four types of settings. The setting '''Private Wiki''' is activated by default.
{| class="wikitable contenttable-blue" style="width:100%;"
! style="width:180px;" |'''Permission type'''
! style="" |'''Description'''
! style="" |'''Special permissions'''
|-
| style="width:180px;" |Public wiki
| style="" |The wiki is visible to and editable by anyone, including anonymous users (that means users that are not logged in).

*All users have edit rights by default.
*To approve a page (if the approval mechanism is activated in a namespace), the groups "editor" and "reviewer" must be assigned to a user.
*To manage the wiki (administrative tasks), the group "sysop" must be assigned to a user.{{Messagebox|boxtype=note|Note text=In BlueSpice cloud, it is not possible to assign ''edit'', ''comment'', or ''upload'' rights to anonymous users.
The setting "Public wiki" is therefore not offered in cloud wikis.}}
| style="" |Sonderverrechtung: <ref name="globalrights">Global permissions (modified by the special permissions shown in the table above):<syntaxhighlight lang="text">
'bureaucrat' => [
'accountmanager' => true
],
'sysop' => [
'reader' => true,
'editor' => true,
'reviewer' => true,
'admin' => true
],
'user' => [ 'editor' => true ],
'editor' => [
'reader' => true,
'editor' => true
],
'reviewer' => [
'reader' => true,
'editor' => true,
'reviewer' => true
</syntaxhighlight></ref><syntaxhighlight lang="text">
// Anonymous and logged-in users can read and edit
$this->groupRoles['*']['reader'] = true;
$this->groupRoles['*']['editor'] = true;
</syntaxhighlight>
|-
| style="width:180px;" |Protected wiki
| style="" |The wiki is visible to anyone. Only logged-in users can edit the wiki.

*All users have edit rights by default.
*To approve a page (if the approval mechanism is activated in a namespace), the groups "editor" and "reviewer" must be assigned to a user.
*To manage the wiki (administrative tasks), the group "sysop" must be assigned to a user.
| style="" |Sonderverrechtung:<ref name="globalrights" />:<syntaxhighlight lang="text">
// Anonymous users can read, logged-in users can edit
$this->groupRoles['*']['reader'] = true;
$this->groupRoles['*']['editor'] = false;
$this->groupRoles['user']['editor'] = true;
</syntaxhighlight>
|-
| style="width:180px;" |Private wiki
| style="" |Only logged-in users can view and edit the wiki.

*Logged-in users only have veiw permissions.
*'''Important!''' To '''edit''' a page, users must be assigned to the "editor" group manually.
*To approve a page (if the approval mechanism is activated in a namespace), the groups "editor" and "reviewer" must be assigned to a user.
*To manage the wiki (administrative tasks), the group "sysop" must be assigned to a user.
| style="" |Sonderverrechtung:<ref name="globalrights" /><syntaxhighlight lang="text">
// Only logged-in users can read. The group "editor" has to be manually assigned to users.
$this->groupRoles['*']['reader'] = false;
$this->groupRoles['*']['editor'] = false;
$this->groupRoles['user']['reader'] = true;
$this->groupRoles['user']['editor'] = false;
$this->groupRoles['editor']['editor'] = true;
$this->groupRoles['sysop']['editor'] = true;
</syntaxhighlight>
|-
| style="width:180px;" |Custom setup
(BlueSpice pro)
| style="" |Roles and groups are assigned by an administrator. This is necessary if different namespaces need to have different user rights. See the next section for more info.
| style="" |
|}
{{Textbox|boxtype=note|header=|text=If you save your personalized settings at least once and then switch back to a "protected" or "private" wiki, you won't lose these personalized settings. You can revert to the last custom settings at any time.|icon=yes}}<references />

== About role-based permissions ==
Roles represent a '''collection of individual permissions''' that are necessary to perform certain functions in the wiki. For example, for a user who is supposed to only read the wiki, many permissions in addition to the "read" permission are needed: The ability to change their own settings, to search the wiki, to view page ratings, and so on.

All permissions that make up a logical group are encapsulated in a role, in this example the role "reader".
If wiki administrators want to grant read-only rights to a user group, they only need to assign that group the "reader" role, instead of assigning many individual permissions that are needed to create a "read"-user.

By assigning roles to a group, all users belonging to that group receive the rights of these roles. Roles are never assigned directly to users, but always to groups instead. Users are then assigned to one or more groups.
[[File:Manual:RightsRolesGroups.png|center|900x900px]]
<br />As a result, the following administration pages play a role in the rights management:

* [[Manual:Extension/BlueSpiceNamespaceManager|Namespace manager]]: In the wiki, user groups can be granted different permissions via roles in individual namespaces.
* [[Manual:Extension/BlueSpiceUserManager|User manager]]: Individual users are assigned to groups to obtain the permissions associated with the group.
* Permission manager (with integrated group manager): In the Permission manager, the user groups are managed and assigned to their roles in the namespaces.

The following elements are part of the rights system:

{| class="contenttable-blue" style="width:100%;"
! style="width:80 %;" |'''Function'''
|-
| style="" |Enables a specific action
|-
| style="" |Combination of rights (rights can only be granted via roles)
|-
| style="" |Entity in the wiki instance database. Has a unique user name and a unique user ID.
|-
| style="" |A collection of users. A user is assigned to one or more groups. There are system-internal groups (which cannot be removed or renamed) and custom groups. In the case of custom groups, the group name often consists of the role and a namespace name.
|-
| style="" |Authorisations can be defined at namespace level. But generally not per page.
|}

== Example rights assignment procedure ==
<bs:drawio filename="Verrechtung" alt="Steps for assigning permissions: Create namespace, create groups for namespace, assign roles to groups, assign users to groups" /><br />

{| class="contenttable-blue" style="width:100%;"
! style="" |'''Step'''
! style="" |'''Function'''
! style="" |'''Description'''
|-
| style="" |'''1'''
| style="" |Namespace management
| style="" |Create a namespace via the <code>Special:NamespaceManager</code> page.
|-
| style="" |'''2'''
| style="" |Group management
| style="" |Create a user group for each role that you want to manage in this namespace via the <code>Special:PermissionManager</code> page. The group name should follow a specific pattern, e.g. <code><namespace_name>_<role_name></code>.
|-
| style="" |'''3'''
| style="" |Rights management
| style="" |Connect groups, roles and namespaces with <code>Special:PermissionManager</code> . Simply follow the name pattern of the group.
|-
| style="" |'''4'''
| style="" |User management
| style="" |Assign users to the groups.
|}

== Custom setup ==
The "Custom setup" is used to assign global and namespace-specific permissions to groups.
[[File:PermissionManager custom setup.png|alt=View of the different sections of the custom permissions setup|center|thumb|750x750px|Custom setup]]
{| class="wikitable" style="width: 100%;"
|+
! style="width:20px;" |Element
! style="" |Function
! style="" |Description
|-
| style="vertical-align:middle;text-align:center;width:20px;" |1
| style="" |Groups panel
| style="" |This panel lists all groups in the wiki:

* '''Automatic groups:''' The "Unauthenticated users" (anonymous users without user account) and "Authenticated users" (users with user accounts) Users fall automatically into one of these groups, if they are not assigned to at least one group. All other groups initially inherit their permissions from the automatic groups.
* '''Groups:''' The built-in groups Editors, Reviewers and Administrators as well as any custom groups an administrator has already created.
* '''New custom groups''' are created as needed from the (<code>+</code>) plus-button.
|-
| style="vertical-align:middle;text-align:center;width:20px;" |2
| style="" |Selected user group
| style="" |The heading shows which group is currently selected for viewing or for setting the permissions.
|-
| style="vertical-align:middle;text-align:center;width:20px;" |3
| style="" |Global permissions
| style="" |You can grant global permissions that apply to the entire wiki for this group. If you want to only grant permissions in one or more specific namespaces, you do not need to select a role here.
|-
| style="vertical-align:middle;text-align:center;width:20px;" |4
| style="" |Namespace-specific permissions
| style="" |Shows a filterable list of all namespaces and their permissions for the selected user group.
If a change is saved here, the group must be selected again in the group list if the setting should be reviewed after saving.
|-
| style="vertical-align:middle;text-align:center;width:20px;" |4
| style="" |Advanced mode
| style="" |This view displays the roles of a user group in a matrix format. The role names are clickable and show the individual permissions within a role.
|}
{{Messagebox|boxtype=note|Note text=If you have saved the personalized settings at least once and then switch back to a "protected" or "private" wiki, you do not lose your latest personalized settings. You can simply resave the latest saved settings to switch back to a wiki with personalized permissions.}}

=== Creating custom groups ===
Groups can be created from the permission manager page to support the following scenarios:

* '''Unique permissions for different namespaces:''' If pages in the wiki should have different permissions than other pages, they need to be located in different namespaces.

* [[Manual:Extension/BlueSpicePageAccess|Page access]]''':''' The purpose of the page access functionality is to override the permissions set on the namespace-level and are usually only used as exceptions. Page-level permissions are difficult to maintain and contradict the namespace-based permissions model.

* [[Manual:Extension/Workflows|Workflows]]: Workflow tasks can be assigned to user groups.
* [[Manual:Extension/BlueSpicePageAssignments|Page assignments]]: Pages can be assigned to groups as well as to individual users.

===Advanced mode===
The permission manager consists of the group tree (1) and the role matrix (2). Namespaces can be added and removed as needed (3):<br />
[[File:Manual:PermissionManager2a.png|center|thumb|650x650px|Associating groups with roles in namespaces|link=Special:FilePath/Manual:PermissionManager2a.png]]

<span><br /></span>The group tree on the left displays all groups. The following groups are available by default:

* Automatically created groups:
** Unauthenticated users: All non-logged-in users (anonymous users) belong to this group.
** Authenticated users: The default group for all logged-in users, even if they don't belong to a subgroup. Permissions are inherited from this group to the groups.
* Groups: These groups first inherit permissions from the automatically created groups. The inherited permissions can be overridden here.
** Built-in groups: These groups are generic and used across namespaces in the wiki.
** Custom groups: Additional groups created by administrators using the corresponding link (+ symbol at the top of the list).

The columns in the role matrix:

* '''Role name:''' The role(s) assigned to a group in specific namespaces to grant user permissions. Clicking on the name displays all permissions assigned to that role.[[File:rechteverwaltung - permissions in a role.png|alt=List with permissions|center|thumb|450x450px|Permissions in the role "editor"]]

*'''Wiki:''' Assignment of a role to the entire wiki. By assigning the role in this column, a user group gets permissions in this role on the wiki (all namespaces).
*'''Individual namespaces:'''
** Roles can be assigned within namespaces. If a group in a namespace is explicitly assigned a role, '''all other groups lose the permissions for that role''' and must be explicitly reassigned if desired.
** Multiple groups can be assigned one or more roles for a namespace.
** The display of additional namespaces can be controlled using the "Namespaces" filter above the matrix view.

===Role inheritance===
All roles assigned to the "unauthenticated users" group are inherited by the "authenticated users" group. All roles explicitly assigned to the "authenticated users" group are inherited by the custom groups. If a group inherits the role from an automatic group in the role matrix, this is displayed in green. In this case, a check mark is not explicitly set.

== Explicitely set namespace permissions ==
If a group is explicitly assigned a specific role in a namespace, that role is automatically revoked from all other groups. In the following example, the read permission in the Training namespace is assigned to the Administrator group:
[[File:permission manager explicitly set roles.png|alt=Training namespace with its selected roles for the Administrators group|center|thumb|500x500px|explicitely set permissions in the namespace "Training"]]

'''All other groups no longer have access to this namespace'''. In the standard view, this is displayed as "denied":
[[File:permission manager access denied.png|alt=Default view of the permissions for the namespace "Training" for authenticated users|center|thumb|500x500px|No access for the selected group in the "Training" namespace]]

To extend access to other groups, these different groups must be clicked and the checkboxes in the "Training" namespace must be explicitly selected.

In the "Advanced Mode" view, the namespace is grayed out if access is denied:
[[File:permission manager access denied advanced mode.png|alt=Blocked namespace "Training"|center|thumb|250x250px|Display in "Advanced mode"]]

== Default roles ==
By default, the permission manager offers a number of predefined roles. The following roles are primarily used:
*'''reader''': basic read access. Users can also edit their personal settings
*'''editor: '''create content, edit and delete content
*'''reviewer: ''' if you have activated the review function and, therefore, work draft pages in a namespace, there must be at least one group with the role of reviewer. By default, the group “reviewer” is available for this purpose. Only users in the reviewer role can approve draft pages. Reviewers generally need read, write and review rights via the corresponding three roles of reader, editor and reviewer. However, if you have not activated the review function in any namespace, you do not need this role in your wiki
*'''admin: '''grants access to all administrative special pages and to all typical administrative features

The following roles can be assigned via the Advanced Mode in addition:
*'''commenter:''' allows the creation of discussion contributions and page ratings, but not of the pages themselves. The editor role includes all the rights of the commenter role. If a group has editor rights, it does not need special commenter rights
*'''accountselfcreate: ''' allows signing in via a connected authentication mechanism (Single-sign on)
*'''author: '''all permissions necessary for creating content on the wiki. Editing, moving, or deleting pages is not possible
*'''structuremanager: '''allows some actions for wiki maintenance such as moving pages, mass deleting pages or searching and replacing text, as well as renaming namespaces
*'''accountmanager: '''enables the administration of user accounts. Since user accounts are managed independently of namespaces in the wiki, this role cannot be restricted to individual namespaces. Grayed-out namespaces have no meaning here as long as the role in the wiki itself is highlighted in green
*'''bot: '''exists to achieve recurring system actions. This role is assigned to the user BSMaintenance in Bluespice via the group bot. The group bot should not be changed
*'''maintenanceadmin: '''similar to the ''admin'' role, but with extended admin rights for maintaining wiki integrity

== Restricting read permissions ==
It is possible to limit read permissions in a namespace by explicitely assigning the role ''reader'' to one or more particular groups. When users in other groups try to access a page in such a namespace, they will get a message that the permissions are denied.
[[File:Manual:permissions-denied.png|alt=Access denied|center|thumb|500x500px|Access denied]]
While a user cannot access the content of the page, the wiki still shows links to these pages to all users in some contexts, even if a user does not have permissions to access the page content itself.

<span><br /></span>
The following lists show which extensions or functionalities do not show links to restricted pages — because they are permissions-aware — and where the links are shown regardless of permissions.

=== Exensions that are permissions-aware ===
Query results and page lists provided by the following extensions do not show links to pages to which the current user has no access on the namespace level:
<span /><br />
* [[Manual:Extension/BlueSpiceExtendedSearch|ExtendedSearch]] (and functionality based on Extended Search in general, e.g. [[Manual:Extension/BlueSpiceTagSearch|TagSearch]], [[Manual:Extension/BlueSpiceExtendedFilelist|ExtendedFilelist]]).
*[[Reference:Semantic MediaWiki|Semantic MediaWiki]]
*[[Manual:Extension/BlueSpiceInsertMagic|TopList]]<span /><br />
=== Extensions and special pages that are not permissions-aware ===
Extensions that provide page lists and that do not hide links to read-restricted pages to the affected users. Examples:
<span /><br />
*[[Reference:DynamicPageList3|DynamicPageList3]]
*[[Manual:Extension/BlueSpiceSmartList|SmartList]]
* [[Reference:BlueSpiceWatchList|WatchList]] (both the tag and the special page)
<span /><br />
In general, all MediaWiki special pages do not check permissions and therefore list these pages for the affected users. Most common examples:
<span /><br />
* Special:RecentChanges
* Special:Bookshelf ('''Note:''' If this is an issue, you can limit access to the namespace ''Book'' to selected groups. The page ''Special:Bookshelf'' then won't show any links to books to users who do not have access to the ''Book'' namespace. Links to individual books can then be provided on various portal pages as needed).
* Category pages: All pages in the namespace ''Category''

=== Transclusion of read-restricted content ===
Content that is transcluded from a page in a read-restricted namespace is only shown to users who have read-permissions in that namespace. All other users only see a linked reference to the source page.

==Technical info==
===Logging===
Every change to the roles is logged in ''Special:Log'', in the ''Permission Manager log'' .
These logs are available only to wiki administrators (users in groups with the role ''admin'').{{Box Links-en|Topic1=[[Manual:Extension/BlueSpiceNamespaceManager| Namespace management]]|Topic2=|Topic3=[[Manual:Extension/BlueSpiceUserManager|User management]]|Topic4=}}<span><br /></span>
{{translation}}

__BS_NO_AUTOMATIC_DOCUMENT_TRANSLATION__

Manual:Extension/BlueSpicePermissionManagerTest

Margit.link-rodrigue — Thu, 05 Nov 2026 16:00:35 GMT

New page

Manual:Extension/BlueSpicePermissionManager

Margit.link-rodrigue — Thu, 05 Nov 2026 15:59:41 GMT

← Older revision		Revision as of 15:59, 5 November 2026
Line 278:		Line 278:
	These logs are available only to wiki administrators (users in groups with the role ''admin'').{{Box Links-en\|Topic1=[[Manual:Extension/BlueSpiceNamespaceManager\| Namespace management]]\|Topic2=\|Topic3=[[Manual:Extension/BlueSpiceUserManager\|User management]]\|Topic4=}}<span><br /></span>		These logs are available only to wiki administrators (users in groups with the role ''admin'').{{Box Links-en\|Topic1=[[Manual:Extension/BlueSpiceNamespaceManager\| Namespace management]]\|Topic2=\|Topic3=[[Manual:Extension/BlueSpiceUserManager\|User management]]\|Topic4=}}<span><br /></span>
	{{translation}}		{{translation}}


			__BS_NO_AUTOMATIC_DOCUMENT_TRANSLATION__

Manual:Extension/BlueSpiceTranslationTransfer

Margit.link-rodrigue — Thu, 05 Nov 2026 15:50:19 GMT

← Older revision		Revision as of 15:50, 5 November 2026
(5 intermediate revisions by the same user not shown)
Line 170:		Line 170:

	== Custom paths ==		== Custom paths ==
	~~In case with~~ some languages there may be a confusion because of separation between top-level domain and language code. We encountered 3 such cases:		For some languages there may be a confusion because of separation between top-level domain and language code. We encountered 3 such cases:
	* Chinese		* Chinese
	** Top level domain is <code>.cn</code>, ~~still~~ language code is <code>zh</code> (~~and~~ possible variations like <code>zh-hk</code> or <code>zh-cn</code>). ~~So if one will create~~ wiki instance named <code>cn</code> ~~- it~~ will not be automatically set up for TranslationTransfer.		** Top level domain:<code>.cn</code>, language code:<code>zh</code> (with possible variations like <code>zh-hk</code> or <code>zh-cn</code>). A wiki instance named <code>cn</code> will not be automatically set up for TranslationTransfer.
	* Swedish		* Swedish
	** Top level domain - <code>.se</code>, ~~but~~ language code is <code>sv</code>.		** Top level domain: <code>.se</code>, language code: <code>sv</code>.
	* Norwegian		* Norwegian
	** Top level domain - <code>.no</code>, ~~but~~ language code is <code>nb</code> ( <code>no</code> is also a "macrolanguage", but MediaWiki uses <code>nb</code>, and as a fallback from <code>no</code> anyways).		** Top level domain: <code>.no</code>, language code:<code>nb</code> ( <code>no</code> is also a "macrolanguage", but MediaWiki uses <code>nb</code>, and as a fallback from <code>no</code> anyways).

	~~In any of cases above, if~~ there is still a need to have <code>cn</code> wiki instance taking part of <code>zh</code> language in TranslationTransfer workflow - it can be done with additional configuration in one of "LocalSettings-similar" files (like <code>post-init-settings.php</code> ), to manually "wire" <code>cn</code> wiki instance with <code>zh</code> language.		If there is still a need to, for example, have a <code>cn</code> wiki instance taking part of the <code>zh</code> language in TranslationTransfer workflow - it can be done with additional configuration in one of "LocalSettings-similar" files (like <code>post-init-settings.php</code> ), to manually "wire" the <code>cn</code> wiki instance with the <code>zh</code> language.

	Example of such configuration:<syntaxhighlight lang="php">$GLOBALS['wgExtensionFunctions'][] = static function() {		Example of such a configuration:<syntaxhighlight lang="php">$GLOBALS['wgExtensionFunctions'][] = static function() {

	$GLOBALS['bsgTranslateTransferTargets'] = [		$GLOBALS['bsgTranslateTransferTargets'] = [
Line 204:		Line 204:
	]		]
	] );		] );
	}</syntaxhighlight>If there is a need to disable translation workflow for ~~some~~ wiki instance (like <code>it</code> which, for example, may be IT department):<syntaxhighlight lang="php">		}</syntaxhighlight>If there is a need to disable the translation workflow for a wiki instance (like <code>it</code> which, for example, may be the IT department wiki instead of a language wiki):<syntaxhighlight lang="php">
	$GLOBALS['wgExtensionFunctions'][] = static function() {		$GLOBALS['wgExtensionFunctions'][] = static function() {

Security:Security Advisories/BSSA-2026-09

Rvogel1 — Thu, 05 Nov 2026 15:12:23 GMT

← Older revision		Revision as of 15:12, 5 November 2026
Line 1:		Line 1:
			'''Update 2026-11-05:''' This advisory was corrected:
			* Not all containers were rebuilt for BlueSpice 5.1.11.2 and 5.2.7.2 on 2026-10-30. The rebuilt images of <code>chat</code>, <code>wire</code>, <code>formula</code>, <code>pdf</code>, <code>diagram</code>, <code>frontendcache</code> and <code>kerberosproxy</code> were published on 2026-11-04. <code>collabpads</code>, <code>proxy</code> and <code>database</code> have not been rebuilt yet. Their risk stays '''low'''. See "Fixed in" and "Solution".
			* New section on Ghostscript (container <code>bluespice/wiki</code>, all editions): Ghostscript contains its own copy of the Brotli library. According to our analysis, this copy already contains the fix. Security scanners may still report it. As a precaution, we recommend disabling the extension PdfHandler. Risk: '''low'''. See [[#Precaution: disable PdfHandler (all editions)\|below]].

	{\| class="wikitable"		{\| class="wikitable"
	\|+		\|+
Line 5:		Line 9:
	\|-		\|-
	\|Date		\|Date
	\|2026-10-29		\|2026-10-29 (updated 2026-11-05)
	\|-		\|-
	\|Severity		\|Severity
	\|reported "critical" (CVSS 3.1: 9.8), BlueSpice assessment: '''critical''' (container <code>bluespice/wiki</code> in BlueSpice pro and farm, publicly readable wikis), '''high''' (same, wikis that require a login), '''medium''' (container <code>bluespice/chat</code>), '''low''' (all other containers)<br />		\|reported "critical" (CVSS 3.1: 9.8), BlueSpice assessment: '''critical''' (container <code>bluespice/wiki</code> in BlueSpice pro and farm, publicly readable wikis), '''high''' (same, wikis that require a login), '''medium''' (container <code>bluespice/chat</code>), '''low''' (all other containers, and Ghostscript in container <code>bluespice/wiki</code> in all editions)<br />
	CVE-2026-115557: reported "critical" (CVSS 4.0: 9.4), BlueSpice assessment: '''medium''' (containers <code>bluespice/ai</code> and <code>bluespice/chat</code>), not affected (all other containers)		CVE-2026-115557: reported "critical" (CVSS 4.0: 9.4), BlueSpice assessment: '''medium''' (containers <code>bluespice/ai</code> and <code>bluespice/chat</code>), not affected (all other containers)
	\|-		\|-
Line 16:		Line 20:
	* Container <code>bluespice/chat</code> in BlueSpice 5.2 up to 5.2.7.1, if the MS Teams integration is used		* Container <code>bluespice/chat</code> in BlueSpice 5.2 up to 5.2.7.1, if the MS Teams integration is used
	* All other containers, including <code>bluespice/wiki</code> in BlueSpice free, contain the affected library, but are not exploitable in default configuration		* All other containers, including <code>bluespice/wiki</code> in BlueSpice free, contain the affected library, but are not exploitable in default configuration
			* Ghostscript in container <code>bluespice/wiki</code> (all editions, all versions up to 5.1.11.2 and 5.2.7.2): own copy of the Brotli library, which most likely already contains the fix (precaution)
	* CVE-2026-115557: Container <code>bluespice/ai</code> in BlueSpice 5.2 before 5.2.8, if the AI service is used		* CVE-2026-115557: Container <code>bluespice/ai</code> in BlueSpice 5.2 before 5.2.8, if the AI service is used
	* CVE-2026-115557 (same issue in Node.js, no own CVE): Container <code>bluespice/chat</code> in BlueSpice 5.2 up to 5.2.7.1, if the chat service is used		* CVE-2026-115557 (same issue in Node.js, no own CVE): Container <code>bluespice/chat</code> in BlueSpice 5.2 up to 5.2.7.1, if the chat service is used
Line 21:		Line 26:
	\|Fixed in		\|Fixed in
	\|		\|
	~~<!-- TODO before publishing: confirm release date and the list of rebuilt containers -->~~		* BlueSpice 5.1.11.2 and BlueSpice 5.2.7.2:
	* BlueSpice 5.1.11.2 and BlueSpice 5.2.7.2 (all containers ~~rebuilt with the fixed Brotli library~~ and ~~Node~~.~~js versions~~, published on <~~date~~>)		** container <code>bluespice/wiki</code> (all editions): published on 2026-10-30
			** containers <code>chat</code> and <code>wire</code> (5.2 only), <code>formula</code>, <code>pdf</code>, <code>diagram</code>, <code>kerberosproxy</code> (5.1 and 5.2) and <code>frontendcache</code> (5.2): published on 2026-11-04
			** <!-- TODO: update when rebuilt --> containers <code>collabpads</code>, <code>proxy</code> and <code>database</code>: not rebuilt yet (risk: low)
			** Ghostscript in container <code>bluespice/wiki</code>: no update available; precaution see below
	* CVE-2026-115557: BlueSpice 5.2.7.2 (container <code>bluespice/chat</code>); BlueSpice 5.2.8 (container <code>bluespice/ai</code>, next regular release)		* CVE-2026-115557: BlueSpice 5.2.7.2 (container <code>bluespice/chat</code>); BlueSpice 5.2.8 (container <code>bluespice/ai</code>, next regular release)
	\|-		\|-
Line 56:		Line 64:
	\|Out-of-bounds write when decompressing data		\|Out-of-bounds write when decompressing data
	\| style="" class="col-green-bg" \|not exploitable		\| style="" class="col-green-bg" \|not exploitable
			\|-
			\|CVE-2026-111497
			\|Ghostscript (container <code>bluespice/wiki</code>, all editions)
			\|Out-of-bounds write when decompressing data
			\| style="" class="col-green-bg" \|most likely fixed, precaution recommended
	\|-		\|-
	\|CVE-2026-115557		\|CVE-2026-115557
Line 90:		Line 103:
	\|-		\|-
	\| style="vertical-align:middle;text-align:left;" \|All other containers, including <code>bluespice/wiki</code> in BlueSpice free		\| style="vertical-align:middle;text-align:left;" \|All other containers, including <code>bluespice/wiki</code> in BlueSpice free
	\| style="vertical-align:middle;text-align:left;" class="col-green-bg" \|'''Low'''. These services contain the affected library, but do not decompress data that users can control. Other features of the wiki that download data (e.g. RSS feeds, PageForms, EmbedVideo, Semantic MediaWiki, search) only use addresses set by administrators or internal services. An attack through them is very unlikely, as it would require a compromised service or a rarely used configuration.		\| style="vertical-align:middle;text-align:left;" class="col-green-bg" \|'''Low'''. These services contain the affected library, but do not decompress data that users can control. Other features of the wiki that download data (e.g. RSS feeds, PageForms, EmbedVideo, Semantic MediaWiki, search) only use addresses set by administrators or internal services. An attack through them is very unlikely, as it would require a compromised service or a rarely used configuration. The same applies to the third-party image <code>mongo:8.2</code>, which <code>bluespice-deploy</code> uses for the database of the <code>collabpads</code> service.
	\| style="vertical-align:middle;text-align:left;" \|None required. Update with the next maintenance.		\| style="vertical-align:middle;text-align:left;" \|None required. Update with the next maintenance.
			\|-
			\| style="vertical-align:middle;text-align:left;" \|Ghostscript in container <code>bluespice/wiki</code> (all editions)
			\| style="vertical-align:middle;text-align:left;" class="col-green-bg" \|'''Low'''. The wiki uses Ghostscript to create preview images of uploaded PDF files. Ghostscript contains its own copy of the Brotli library. According to our analysis of the source code, this copy already contains the fix, but it still reports the old version number. Security scanners may therefore report it as affected. We could not fully verify the compiled program and know of no exploit code for Ghostscript. An attack would require a user who is allowed to upload files. Usually only logged-in users with edit rights can do this, also on publicly readable wikis.
			\| style="vertical-align:middle;text-align:left;" \|As a precaution, disable the extension PdfHandler (see below).
	\|-		\|-
	\| style="vertical-align:middle;text-align:left;" \|Container <code>bluespice/ai</code> (CVE-2026-115557)		\| style="vertical-align:middle;text-align:left;" \|Container <code>bluespice/ai</code> (CVE-2026-115557)
Line 107:		Line 124:

	== Solution ==		== Solution ==
	Update to '''BlueSpice 5.2.7.2''' or '''BlueSpice 5.1.11.2'''. As with [[Security:Security Advisories/BSSA-2026-08\|BSSA-2026-08]], these are nano releases without functional changes. We recommend the update for <code>bluespice/wiki</code> in all editions (free, pro and farm). ~~All~~ containers ~~except <code>bluespice/ai</code>~~ were rebuilt with the fixed Brotli library (<code>brotli-libs 1.2.1</code>) and fixed Node.js versions. ~~The~~ image tags <code>5</code>, <code>5.2</code> and <code>5.1</code> point to the fixed images.		Update to '''BlueSpice 5.2.7.2''' or '''BlueSpice 5.1.11.2'''. As with [[Security:Security Advisories/BSSA-2026-08\|BSSA-2026-08]], these are nano releases without functional changes. We recommend the update for <code>bluespice/wiki</code> in all editions (free, pro and farm). The containers listed under "Fixed in" were rebuilt with the fixed Brotli library (<code>brotli-libs 1.2.1</code>) and fixed Node.js versions. For these containers, the image tags <code>5</code>, <code>5.2</code> and <code>5.1</code> point to the fixed images. <code>collabpads</code>, <code>proxy</code> and <code>database</code> will follow (risk: low). If you have already updated to 5.2.7.2 or 5.1.11.2 before 2026-11-04, run the update commands again to get the rebuilt service containers.

	In the <code>.env</code> file of <code>bluespice-deploy</code>, set <code>VERSION</code> to <code>5.2</code> or <code>5.1</code>. Then run these commands in the <code>compose</code> directory of <code>bluespice-deploy</code>: <code>./bluespice-deploy pull && ./bluespice-deploy up -d</code>. Use the <code>bluespice-deploy</code> script instead of plain <code>docker compose</code>, because only the script loads all required <code>docker-compose.*.yml</code> files.		In the <code>.env</code> file of <code>bluespice-deploy</code>, set <code>VERSION</code> to <code>5.2</code> or <code>5.1</code>. Then run these commands in the <code>compose</code> directory of <code>bluespice-deploy</code>: <code>./bluespice-deploy pull && ./bluespice-deploy up -d</code>. Use the <code>bluespice-deploy</code> script instead of plain <code>docker compose</code>, because only the script loads all required <code>docker-compose.*.yml</code> files.
Line 134:		Line 151:

	While the extensions are disabled, pages that use them show the parser functions as plain text or no data. No content is lost.		While the extensions are disabled, pages that use them show the parser functions as plain text or no data. No content is lost.

			=== Precaution: disable PdfHandler (all editions) ===
			The extension PdfHandler creates preview images of uploaded PDF files with Ghostscript. Ghostscript contains its own copy of the Brotli library and does not use the system library <code>brotli-libs</code>. The update to 5.2.7.2 or 5.1.11.2 therefore does not change it. According to our analysis, this copy already contains the fix (see "Impact assessment"). Because we cannot fully verify this, we recommend disabling PdfHandler as a precaution until an updated Ghostscript is available.

			Use the same method as above with the file <code>030-BlueSpiceFreeDistribution.php</code>:
			<syntaxhighlight lang="bash">
			./bluespice-deploy cp wiki-web:/app/bluespice/w/settings.d/030-BlueSpiceFreeDistribution.php ./
			sed -i -E "s/^(wfLoadExtension$ 'PdfHandler' $;)/#\1/" 030-BlueSpiceFreeDistribution.php
			grep -n "PdfHandler" 030-BlueSpiceFreeDistribution.php
			</syntaxhighlight>
			The last command must show <code>#wfLoadExtension( 'PdfHandler' );</code>. Add the file to <code>docker-compose.override.yml</code>:
			<syntaxhighlight lang="yaml">
			services:
			wiki-web:
			volumes:
			- ./030-BlueSpiceFreeDistribution.php:/app/bluespice/w/settings.d/030-BlueSpiceFreeDistribution.php:ro
			# same for wiki-task and wiki-installer
			</syntaxhighlight>
			If you also disable ExternalData and ExternalContent, add both files to the <code>volumes</code> list. Then re-create the containers with <code>./bluespice-deploy up -d</code>. The copied file belongs to the current version. '''Remove the mount before or together with the next update.''' We will announce here when an updated Ghostscript is available.

			While PdfHandler is disabled, PDF files can still be uploaded and downloaded. The wiki does not create new preview images for them and shows a file icon instead. No content is lost.

	=== Was my installation compromised? ===		=== Was my installation compromised? ===
Line 147:		Line 185:
	=== BlueSpice cloud ===		=== BlueSpice cloud ===
	<!-- TODO: Operations to confirm status of the cloud instances before publishing -->		<!-- TODO: Operations to confirm status of the cloud instances before publishing -->
	BlueSpice cloud uses the same containers and will be updated by Hallo Welt! GmbH, including the AI service. No action is required from cloud customers.		<!-- TODO (2026-11-05): Operations to confirm whether PdfHandler is disabled in the cloud as a precaution -->
			BlueSpice cloud uses the same containers and will be updated by Hallo Welt! GmbH, including the AI service. No action is required from cloud customers.⏎

Security:Security Advisories/BSSA-2026-09

Mglaser — Fri, 30 Oct 2026 13:35:49 GMT

Security:Security Advisories/BSSA-2026-09

Rvogel1 — Fri, 30 Oct 2026 12:57:06 GMT

← Older revision		Revision as of 12:57, 30 October 2026
Line 8:		Line 8:
	\|-		\|-
	\|Severity		\|Severity
	\|reported "critical" (CVSS 3.1: 9.8), BlueSpice assessment: '''critical''' (container <code>bluespice/wiki</code> in BlueSpice pro and farm, publicly readable wikis), '''high''' (same, wikis that require a login), '''medium''' (container <code>bluespice/chat</code>), '''low''' (all other containers)		\|reported "critical" (CVSS 3.1: 9.8), BlueSpice assessment: '''critical''' (container <code>bluespice/wiki</code> in BlueSpice pro and farm, publicly readable wikis), '''high''' (same, wikis that require a login), '''medium''' (container <code>bluespice/chat</code>), '''low''' (all other containers)<br />
			CVE-2026-115557: reported "critical" (CVSS 4.0: 9.4), BlueSpice assessment: '''medium''' (containers <code>bluespice/ai</code> and <code>bluespice/chat</code>), not affected (all other containers)
	\|-		\|-
	\|Affected		\|Affected
Line 15:		Line 16:
	* Container <code>bluespice/chat</code> in BlueSpice 5.2 up to 5.2.7.1, if the MS Teams integration is used		* Container <code>bluespice/chat</code> in BlueSpice 5.2 up to 5.2.7.1, if the MS Teams integration is used
	* All other containers, including <code>bluespice/wiki</code> in BlueSpice free, contain the affected library, but are not exploitable in default configuration		* All other containers, including <code>bluespice/wiki</code> in BlueSpice free, contain the affected library, but are not exploitable in default configuration
			* CVE-2026-115557: Container <code>bluespice/ai</code> in BlueSpice 5.2 before 5.2.8, if the AI service is used
			* CVE-2026-115557 (same issue in Node.js, no own CVE): Container <code>bluespice/chat</code> in BlueSpice 5.2 up to 5.2.7.1, if the chat service is used
	\|-		\|-
	\|Fixed in		\|Fixed in
Line 20:		Line 23:
	<!-- TODO before publishing: confirm release date and the list of rebuilt containers -->		<!-- TODO before publishing: confirm release date and the list of rebuilt containers -->
	* BlueSpice 5.1.11.2 and BlueSpice 5.2.7.2 (all containers rebuilt with the fixed Brotli library and Node.js versions, published on <date>)		* BlueSpice 5.1.11.2 and BlueSpice 5.2.7.2 (all containers rebuilt with the fixed Brotli library and Node.js versions, published on <date>)
			* CVE-2026-115557: BlueSpice 5.2.7.2 (container <code>bluespice/chat</code>); BlueSpice 5.2.8 (container <code>bluespice/ai</code>, next regular release)
	\|-		\|-
	\|CVE		\|CVE
	\|		\|
	* [https://nvd.nist.gov/vuln/detail/CVE-2026-111497 CVE-2026-111497]		* [https://nvd.nist.gov/vuln/detail/CVE-2026-111497 CVE-2026-111497]
			* [https://www.cve.org/CVERecord?id=CVE-2026-115557 CVE-2026-115557]
	\|}		\|}

	==Problem==		==Problem==
	A vulnerability in the Brotli decompression library (publicly known as "Node2Shell") allows an attacker to write beyond a memory buffer by sending specially crafted compressed data. This can crash the program, reveal memory contents and allow the attacker to run code. The library is used by Node.js and by many Linux programs, e.g. the <code>curl</code> library that PHP uses for outgoing HTTP requests. Public exploit code exists for Node.js applications and for PHP applications that download data from web addresses. The US authority CISA lists the vulnerability as actively exploited.		A vulnerability in the Brotli decompression library (publicly known as "Node2Shell") allows an attacker to write beyond a memory buffer by sending specially crafted compressed data. This can crash the program, reveal memory contents and allow the attacker to run code. The library is used by Node.js and by many Linux programs, e.g. the <code>curl</code> library that PHP uses for outgoing HTTP requests. Public exploit code exists for Node.js applications and for PHP applications that download data from web addresses. The US authority CISA lists the vulnerability as actively exploited.

			'''CVE-2026-115557:''' The private keys of several intermediate certificates of the certificate authority eMudhra were generated incorrectly and are publicly known. Anyone can create certificates for any website with them. Browsers already block these certificates, but many programs that check certificates only against a list of trusted root certificates still accept them. Python and Node.js, which the AI service and the chat service use, were updated to block them. Older Python versions are safe if their list of trusted root certificates is up to date.

	{\| class="wikitable"		{\| class="wikitable"
Line 49:		Line 56:
	\|Out-of-bounds write when decompressing data		\|Out-of-bounds write when decompressing data
	\| style="" class="col-green-bg" \|not exploitable		\| style="" class="col-green-bg" \|not exploitable
			\|-
			\|CVE-2026-115557
			\|Python (container <code>bluespice/ai</code>)
			\|Forged server certificates are accepted for outgoing connections
			\| style="" class="col-orange-bg" \|affected, if the AI service is used
			\|-
			\|CVE-2026-115557 (same issue in Node.js)
			\|Node.js (container <code>bluespice/chat</code>)
			\|Forged server certificates are accepted for outgoing connections
			\| style="" class="col-orange-bg" \|affected, if the chat service is used
			\|-
			\|CVE-2026-115557
			\|Python / Node.js / Java (other containers)
			\|Forged server certificates are accepted for outgoing connections
			\| style="" class="col-green-bg" \|not affected
	\|}		\|}

Line 70:		Line 92:
	\| style="vertical-align:middle;text-align:left;" class="col-green-bg" \|Low. These services contain the affected library, but do not decompress data that users can control. Other features of the wiki that download data (e.g. RSS feeds, PageForms, EmbedVideo, Semantic MediaWiki, search) only use addresses set by administrators or internal services. An attack through them is very unlikely, as it would require a compromised service or a rarely used configuration.		\| style="vertical-align:middle;text-align:left;" class="col-green-bg" \|Low. These services contain the affected library, but do not decompress data that users can control. Other features of the wiki that download data (e.g. RSS feeds, PageForms, EmbedVideo, Semantic MediaWiki, search) only use addresses set by administrators or internal services. An attack through them is very unlikely, as it would require a compromised service or a rarely used configuration.
	\| style="vertical-align:middle;text-align:left;" \|None required. Update with the next maintenance.		\| style="vertical-align:middle;text-align:left;" \|None required. Update with the next maintenance.
			\|-
			\| style="vertical-align:middle;text-align:left;" \|Container <code>bluespice/ai</code> (CVE-2026-115557)
			\| style="vertical-align:middle;text-align:left;" class="col-orange-bg" \|Medium. The AI service is not part of standard installations. It sends questions, wiki content and the API key of the AI provider (e.g. Azure OpenAI, OpenAI, Google, IONOS) over encrypted connections. It still accepts the forged certificates. An attacker who can intercept and redirect the network traffic between your server and the AI provider can read the API key and the wiki content and change the answers. Access to the wiki is not required. However, the attacker must control the network path, e.g. a router, DNS or proxy server between your server and the AI provider. This makes an attack difficult. We do not know of any attacks.
			\| style="vertical-align:middle;text-align:left;" \|Disable the AI service until BlueSpice 5.2.8: set <code>AI=false</code> in the <code>.env</code> file and run <code>./bluespice-deploy up -d --remove-orphans</code>. The AI features of the wiki and the chat are not available until then.
			\|-
			\| style="vertical-align:middle;text-align:left;" \|Container <code>bluespice/chat</code> (CVE-2026-115557, same issue in Node.js)
			\| style="vertical-align:middle;text-align:left;" class="col-orange-bg" \|Medium. Same issue as for the AI service. The chat service accepts the forged certificates on its connections to MS Teams or Slack. An attacker who controls the network path can read and change chat messages and read the access credentials of the connector.
			\| style="vertical-align:middle;text-align:left;" \|None. Update to BlueSpice 5.2.7.2, or disable the chat service.
			\|-
			\| style="vertical-align:middle;text-align:left;" \|All other containers (CVE-2026-115557)
			\| style="vertical-align:middle;text-align:left;" class="col-green-bg" \|Not affected. <code>bluespice/wiki</code> and <code>bluespice/search</code> contain Python, but either already reject the forged certificates or make no outgoing connections. The same applies to Node.js and Java in the other containers.
			\| style="vertical-align:middle;text-align:left;" \|None required.
	\|}		\|}

	== Solution ==		== Solution ==
	Update to '''BlueSpice 5.2.7.2''' or '''BlueSpice 5.1.11.2'''. As with [[Security:Security Advisories/BSSA-2026-08\|BSSA-2026-08]], these are nano releases without functional changes. We recommend the update for <code>bluespice/wiki</code> in all editions (free, pro and farm). All containers were rebuilt with the fixed Brotli library (<code>brotli-libs 1.2.1</code>) and fixed Node.js versions. The image tags <code>5</code>, <code>5.2</code> and <code>5.1</code> point to the fixed images.		Update to '''BlueSpice 5.2.7.2''' or '''BlueSpice 5.1.11.2'''. As with [[Security:Security Advisories/BSSA-2026-08\|BSSA-2026-08]], these are nano releases without functional changes. We recommend the update for <code>bluespice/wiki</code> in all editions (free, pro and farm). All containers except <code>bluespice/ai</code> were rebuilt with the fixed Brotli library (<code>brotli-libs 1.2.1</code>) and fixed Node.js versions. The image tags <code>5</code>, <code>5.2</code> and <code>5.1</code> point to the fixed images.

	In the <code>.env</code> file of <code>bluespice-deploy</code>, set <code>VERSION</code> to <code>5.2</code> or <code>5.1</code>. Then run these commands in the <code>compose</code> directory of <code>bluespice-deploy</code>: <code>./bluespice-deploy pull && ./bluespice-deploy up -d</code>. Use the <code>bluespice-deploy</code> script instead of plain <code>docker compose</code>, because only the script loads all required <code>docker-compose.*.yml</code> files.		In the <code>.env</code> file of <code>bluespice-deploy</code>, set <code>VERSION</code> to <code>5.2</code> or <code>5.1</code>. Then run these commands in the <code>compose</code> directory of <code>bluespice-deploy</code>: <code>./bluespice-deploy pull && ./bluespice-deploy up -d</code>. Use the <code>bluespice-deploy</code> script instead of plain <code>docker compose</code>, because only the script loads all required <code>docker-compose.*.yml</code> files.
Line 80:		Line 114:
	* <code>./bluespice-deploy exec wiki-web apk info -v brotli-libs</code> and <code>./bluespice-deploy exec wiki-task apk info -v brotli-libs</code>: must show <code>brotli-libs-1.2.1-r0</code> or higher		* <code>./bluespice-deploy exec wiki-web apk info -v brotli-libs</code> and <code>./bluespice-deploy exec wiki-task apk info -v brotli-libs</code>: must show <code>brotli-libs-1.2.1-r0</code> or higher
	* <code>./bluespice-deploy exec chat node -v</code> (BlueSpice 5.2, only if the chat service is used): must show <code>v24.22.1</code> or higher		* <code>./bluespice-deploy exec chat node -v</code> (BlueSpice 5.2, only if the chat service is used): must show <code>v24.22.1</code> or higher

			The container <code>bluespice/ai</code> was '''not''' rebuilt for BlueSpice 5.2.7.2. It will be fixed in BlueSpice 5.2.8. Until then, disable the AI service as described in the table above, if you use it.

	=== Mitigation without update: disable ExternalData and ExternalContent (BlueSpice pro and farm) ===		=== Mitigation without update: disable ExternalData and ExternalContent (BlueSpice pro and farm) ===
Line 111:		Line 147:
	=== BlueSpice cloud ===		=== BlueSpice cloud ===
	<!-- TODO: Operations to confirm status of the cloud instances before publishing -->		<!-- TODO: Operations to confirm status of the cloud instances before publishing -->
	BlueSpice cloud uses the same containers and will be updated by Hallo Welt! GmbH. No action is required from cloud customers.		BlueSpice cloud uses the same containers and will be updated by Hallo Welt! GmbH, including the AI service. No action is required from cloud customers.

Security:Security Advisories

Rvogel1 — Fri, 30 Oct 2026 12:54:52 GMT

← Older revision		Revision as of 12:54, 30 October 2026
(One intermediate revision by the same user not shown)
Line 6:		Line 6:
	! style="" \|Summary		! style="" \|Summary
	!Severity		!Severity
			\|-
			\| [[Security:Security Advisories/BSSA-2026-09\|BSSA-2026-09]]
			\| 2026-10-29
			\| Out-of-bounds write in Brotli decompression ("Node2Shell") affecting wiki (pro/farm) and chat containers; forged eMudhra certificates accepted by the AI and chat services
			\| [https://www.cve.org/CVERecord?id=CVE-2026-111497 CVE-2026-111497], [https://www.cve.org/CVERecord?id=CVE-2026-115557 CVE-2026-115557]
			\| Out-of-bounds write, Remote Code Execution; Improper certificate validation
			\| style="" class="col-purple-bg" \| Critical
	\|-		\|-
	\| [[Security:Security Advisories/BSSA-2026-08\|BSSA-2026-08]]		\| [[Security:Security Advisories/BSSA-2026-08\|BSSA-2026-08]]

Security:Security Advisories/BSSA-2026-09

Rvogel1 — Fri, 30 Oct 2026 11:32:13 GMT

Created page with "{| class="wikitable" |+ ! ! |- |Date |2026-10-29 |- |Severity |reported "critical" (CVSS 3.1: 9.8), BlueSpice assessment: '''critical''' (container <code>bluespice/wiki</code> in BlueSpice pro and farm, publicly readable wikis), '''high''' (same, wikis that require a login), '''medium''' (container <code>bluespice/chat</code>), '''low''' (all other containers) |- |Affected | * Container <code>bluespice/wiki</code> in BlueSpice pro and farm 5.1 up to 5.1.11.1 and 5.2 up t..."

New page

{| class="wikitable"
|+
!
!
|-
|Date
|2026-10-29
|-
|Severity
|reported "critical" (CVSS 3.1: 9.8), BlueSpice assessment: '''critical''' (container <code>bluespice/wiki</code> in BlueSpice pro and farm, publicly readable wikis), '''high''' (same, wikis that require a login), '''medium''' (container <code>bluespice/chat</code>), '''low''' (all other containers)
|-
|Affected
|
* Container <code>bluespice/wiki</code> in BlueSpice pro and farm 5.1 up to 5.1.11.1 and 5.2 up to 5.2.7.1
* Container <code>bluespice/chat</code> in BlueSpice 5.2 up to 5.2.7.1, if the MS Teams integration is used
* All other containers, including <code>bluespice/wiki</code> in BlueSpice free, contain the affected library, but are not exploitable in default configuration
|-
|Fixed in
|

* BlueSpice 5.1.11.2 and BlueSpice 5.2.7.2 (all containers rebuilt with the fixed Brotli library and Node.js versions, published on <date>)
|-
|CVE
|
* [https://nvd.nist.gov/vuln/detail/CVE-2026-111497 CVE-2026-111497]
|}

==Problem==
A vulnerability in the Brotli decompression library (publicly known as "Node2Shell") allows an attacker to write beyond a memory buffer by sending specially crafted compressed data. This can crash the program, reveal memory contents and allow the attacker to run code. The library is used by Node.js and by many Linux programs, e.g. the <code>curl</code> library that PHP uses for outgoing HTTP requests. Public exploit code exists for Node.js applications and for PHP applications that download data from web addresses. The US authority CISA lists the vulnerability as actively exploited.

{| class="wikitable"
!'''CVE'''
!'''Component'''
!'''Type of vulnerability'''
!'''BlueSpice 5'''
|-
|CVE-2026-111497
|Brotli library (container <code>bluespice/wiki</code> in BlueSpice pro and farm)
|Out-of-bounds write when decompressing data, remote code execution
| style="" class="col-purple-bg" |affected
|-
|CVE-2026-111497
|Node.js (container <code>bluespice/chat</code>)
|Out-of-bounds write when decompressing data, possibly remote code execution
| style="" class="col-orange-bg" |affected, if MS Teams integration is used
|-
|CVE-2026-111497
|Brotli library / Node.js (other containers)
|Out-of-bounds write when decompressing data
| style="" class="col-green-bg" |not exploitable
|}

==Impact assessment==
{| class="wikitable" style="width: 100%;"
!Component
!Assessment
!Mitigation without update
|-
| style="vertical-align:middle;text-align:left;" |Container <code>bluespice/wiki</code> (BlueSpice pro and farm)
| style="vertical-align:middle;text-align:left;" class="col-purple-bg" |Critical on publicly readable wikis, high on wikis that require a login. The extensions ExternalData (BlueSpice 5.1 and 5.2) and ExternalContent (BlueSpice 5.2) let users load data from any web address into a page. The wiki decompresses this data with the affected library. An attacker who controls a web server can use this to run commands in the wiki container. Public exploit code shows this for a comparable PHP application.

Unlike the PHP vulnerabilities in [[Security:Security Advisories/BSSA-2026-08|BSSA-2026-08]], network access to the wiki is not enough. The attacker needs '''read access to the wiki''' itself. On wikis that require a login, only logged-in users can exploit the vulnerability. The main risk is on publicly readable wikis, where no login is needed. Such wikis are rare among BlueSpice installations. In addition, the wiki must be able to connect to the attacker's server on the internet.
| style="vertical-align:middle;text-align:left;" |Disable the extensions ExternalData and ExternalContent (see below).
|-
| style="vertical-align:middle;text-align:left;" |Container <code>bluespice/chat</code>
| style="vertical-align:middle;text-align:left;" class="col-orange-bg" |Medium. The chat service is not part of standard installations. Its MS Teams connector decompresses incoming requests before it checks whether they come from Microsoft. This connector is not reachable from outside in the default configuration of <code>bluespice-deploy</code>. If you have made it reachable for MS Teams, the risk is high: an attacker without login could possibly run code in the chat container.
| style="vertical-align:middle;text-align:left;" |Do not expose the MS Teams connector, or reject requests with the header <code>Content-Encoding: br</code> in the reverse proxy in front of it.
|-
| style="vertical-align:middle;text-align:left;" |All other containers, including <code>bluespice/wiki</code> in BlueSpice free
| style="vertical-align:middle;text-align:left;" class="col-green-bg" |Low. These services contain the affected library, but do not decompress data that users can control. Other features of the wiki that download data (e.g. RSS feeds, PageForms, EmbedVideo, Semantic MediaWiki, search) only use addresses set by administrators or internal services. An attack through them is very unlikely, as it would require a compromised service or a rarely used configuration.
| style="vertical-align:middle;text-align:left;" |None required. Update with the next maintenance.
|}

== Solution ==
Update to '''BlueSpice 5.2.7.2''' or '''BlueSpice 5.1.11.2'''. As with [[Security:Security Advisories/BSSA-2026-08|BSSA-2026-08]], these are nano releases without functional changes. We recommend the update for <code>bluespice/wiki</code> in all editions (free, pro and farm). All containers were rebuilt with the fixed Brotli library (<code>brotli-libs 1.2.1</code>) and fixed Node.js versions. The image tags <code>5</code>, <code>5.2</code> and <code>5.1</code> point to the fixed images.

In the <code>.env</code> file of <code>bluespice-deploy</code>, set <code>VERSION</code> to <code>5.2</code> or <code>5.1</code>. Then run these commands in the <code>compose</code> directory of <code>bluespice-deploy</code>: <code>./bluespice-deploy pull && ./bluespice-deploy up -d</code>. Use the <code>bluespice-deploy</code> script instead of plain <code>docker compose</code>, because only the script loads all required <code>docker-compose.*.yml</code> files.

To check whether your installation is fixed, run:
* <code>./bluespice-deploy exec wiki-web apk info -v brotli-libs</code> and <code>./bluespice-deploy exec wiki-task apk info -v brotli-libs</code>: must show <code>brotli-libs-1.2.1-r0</code> or higher
* <code>./bluespice-deploy exec chat node -v</code> (BlueSpice 5.2, only if the chat service is used): must show <code>v24.22.1</code> or higher

=== Mitigation without update: disable ExternalData and ExternalContent (BlueSpice pro and farm) ===
Use the same method as in [[Security:Security Advisories/BSSA-2026-06#Mitigation:_disable_Extension:ExternalData|BSSA-2026-06]]: mount a copy of the settings file in which the extensions are not loaded. In BlueSpice 5.1, the command only finds ExternalData, as ExternalContent is not part of 5.1.
<syntaxhighlight lang="bash">
./bluespice-deploy cp wiki-web:/app/bluespice/w/settings.d/040-BlueSpiceProDistribution.php ./
sed -i -E "s/^(wfLoadExtension$ 'External(Data|Content)' $;)/#\1/" 040-BlueSpiceProDistribution.php
</syntaxhighlight>
Add the file to <code>docker-compose.override.yml</code>:
<syntaxhighlight lang="yaml">
services:
wiki-web:
volumes:
- ./040-BlueSpiceProDistribution.php:/app/bluespice/w/settings.d/040-BlueSpiceProDistribution.php:ro
# same for wiki-task and wiki-installer
</syntaxhighlight>
Then re-create the containers with <code>./bluespice-deploy up -d</code>. The copied file belongs to the current version. '''Remove the mount before or together with the update.'''

While the extensions are disabled, pages that use them show the parser functions as plain text or no data. No content is lost.

=== Was my installation compromised? ===
We do not know of any attacks on BlueSpice installations. The vulnerability has been public since 2026-10-21. Public exploit code for a comparable PHP application exists since 2026-10-28.

Installing the update or disabling the extensions stops further exploitation. It does not remove anything an attacker may have left behind. If your wiki uses BlueSpice pro or farm and could connect to servers on the internet, check:
# '''Pages, templates and modules''' with <code><nowiki>{{#get_web_data}}</nowiki></code>, <code><nowiki>{{#get_external_data}}</nowiki></code> or <code><nowiki>{{#embed}}</nowiki></code> that point to servers you do not know, and modules that use <code>mw.ext.externalData</code>.
# '''The access log of the reverse proxy''' for requests to <code>api.php</code> or <code>index.php</code> with these functions. They can also be used without saving a page, e.g. in a preview. See the notes on log analysis in [[Security:Security Advisories/BSSA-2026-06|BSSA-2026-06]].
# '''The logs of <code>wiki-web</code> and <code>wiki-task</code>''' for processes that ended with a segmentation fault (e.g. <code>exited on signal 11</code>), and, if available, your firewall logs for connections from the wiki to unknown servers.

If you find signs of an attack, follow the procedure in [[Security:Security Advisories/BSSA-2026-08|BSSA-2026-08]] (section "Was my installation compromised?") and contact the Hallo Welt! GmbH support.

=== BlueSpice cloud ===

BlueSpice cloud uses the same containers and will be updated by Hallo Welt! GmbH. No action is required from cloud customers.

Manual:Extension/ContentDroplets/Icon

Margit.link-rodrigue — Tue, 27 Oct 2026 15:24:31 GMT

@@ Line 1: / Line 1: @@
-==<span class="mw-headline" id="Using_the_template">Using the template</span>==
+==About icons==
 === Bootstrap icons ===
-#'''Find''' a bootstrap icon from the [https://en.wiki.bluespice.com/w/skins/BlueSpiceDiscovery/resources/bootstrap/icons/index.html '''list of currently supported icons.''']
+#'''Find''' a Bootstrap or FontAwesome icon.
-#'''Click''' on the i<nowiki/>con you would like to use. The icon page shows you the class-name of <nowiki/>the icon on the right side of the page:
+#'''Highlight''' the <nowiki/>class name (it has the format ''bi bi-myicon'') and '''copy''' it to your clipb<nowiki/>oard (ctrl+c) (or remember the class name).
 #'''Go back''' to your wiki page.
 #'''Open''' the Droplets dialog in VisualEditor:
@@ Line 11: / Line 17: @@
 ##'''Click''' on the Icon-card
 ##'''Click''' the ''Insert'' button
-# '''Copy''' the icon class from your clipboard:[[File:template-editor-icon.png|alt=Template editor|center|thumb|450x450px|Template editor]]
+# '''Copy''' the icon class from your clipboard (or enter it manually):[[File:template-editor-icon.png|alt=Template editor|center|thumb|450x450px|Template editor]]
 #'''Change''' the font size (optional) if you want the size to be different from the text surrounding it (e.g., from the size of a heading if the icon is placed in the heading or of the paragraph text if the icon is placed in the flow-text.  Smaller than text icons are usually sized no smaller than 0.85em and larger icons up to 2.5em.
 #'''Color:''' If you want the color to be different from the surrounding text, you can specify any web color (e.g., a color name like blue or a hex-valuesuch as #0059b3 for a more specific blue). A list of web colors can be found at https://www.w3schools.com/colors/colors_picker.asp
@@ Line 21: / Line 27: @@
 [[File:bootstrap-icon-on page.png|alt=Inserted Bootstrap icon|center|thumb|450x450px|Inserted Bootstrap icon]]
-=== FontAwesome icons ===
+== Icon selection ==
-The exension [[Reference:FontAwesome|FontAwesome]] is bundled starting at BlueSpice version 4.3. In one of our next patches, we will add the possibility to use them in the Icon droplet. In the meantime, you can add FontAwesome icons with the <code><nowiki>{{#fas:...}}</nowiki></code> parser-function in source edit mode. [[mediawikiwiki:Extension:FontAwesome#Usage|See the official MediaWiki documentation]].
+Here is a selection of supported icons and their class names.
-== Icon-Auswahl ==
+=== Bootstrap icons ===
 https://icons.getbootstrap.com/
-Diese Icons haben die Syntax <code>bi bi-<iconname></code>.
+These icons have the syntax  <code>bi bi-<iconname></code>.
@@ Line 77: / Line 80: @@
 {{IconCard|globe}}
 {{IconCard|shield-check}}
 </div>
-=== FontAwesome Icons ===
+=== FontAwesome icons ===
 https://fontawesome.com/search?ic=free-collection
-Diese Icons haben die Syntax <code>fas-fa-<iconname></code>.
@@ Line 133: / Line 163: @@
 {{IconCardFA|lightbulb}}
 {{IconCardFA|globe}}
 __FORCETOC__

Template:IconCardFA

Margit.link-rodrigue — Tue, 27 Oct 2026 15:11:41 GMT

Created page with "<div style="width:110px; border:1px solid #ddd; border-radius:6px; padding:8px 4px; text-align:center; background:#fff;"> <div style="font-size:1.6em;">{{Icon|fas fa-{{{1}}}|||}}</div> <div style="font-size:0.75em; margin-top:4px;"><code>fas fa-{{{1}}}</code></div> </div>"

New page

Template:IconCard

Margit.link-rodrigue — Tue, 27 Oct 2026 15:11:25 GMT

Created page with "<div style="width:110px; border:1px solid #ddd; border-radius:6px; padding:8px 4px; text-align:center; background:#fff;"> <div style="font-size:1.6em;">{{Icon|bi bi-{{{1}}}|||}}</div> <div style="font-size:0.75em; margin-top:4px;"><code>bi bi-{{{1}}}</code></div> </div>"

New page

Manual:Extension/ContentDroplets/Icon

Margit.link-rodrigue — Tue, 27 Oct 2026 15:11:05 GMT

@@ Line 23: / Line 23: @@
 === FontAwesome icons ===
 The exension [[Reference:FontAwesome|FontAwesome]] is bundled starting at BlueSpice version 4.3. In one of our next patches, we will add the possibility to use them in the Icon droplet. In the meantime, you can add FontAwesome icons with the <code><nowiki>{{#fas:...}}</nowiki></code> parser-function in source edit mode. [[mediawikiwiki:Extension:FontAwesome#Usage|See the official MediaWiki documentation]].
 __FORCETOC__

Manual:Login

Margit.link-rodrigue — Mon, 26 Oct 2026 11:12:03 GMT

← Older revision		Revision as of 11:12, 26 October 2026
(11 intermediate revisions by the same user not shown)
Line 1:		Line 1:
	~~SFSAFSAFSAF~~		While public wikis usually don't require you to log in to read their content, most company wikis are log-in based, especially if you want to contribute articles. Unless your wiki has a single sign-on on solution installed, you will see a login screen before you can access the wiki.
	~~dddd~~

			When logging in for the first time, you usually have to change your password and [[Manual:Extension/BlueSpicePrivacy\|confirm the privacy policy and the terms of use]] .
			<br />
			[[File:Manual:BlueSpice_Login_Screen_en.png\|center\|450x258px\|A typical BlueSpice Login screen\|border]]
			<br />By the way: if you want to stay logged in for a while, just check the box ''Keep me logged in''. That way you don't need to re-enter your data every time you visit the wiki. Your login is stored in a browser cookie on your system. If you delete your browser cookies, you have to provide your login information next time you want to use the wiki. d

			== Password reset ==
			If you forgot your password, there is a link on the login page to reset it . You need to either provide your username or your email address. Please note the following restrictions:

	~~ddddd~~		* You can only request a limited number of password resets within a short period of time. Only one password reset email will be sent per valid account every 24 hours.
			* A temporary password expires in 7 days.
			* The original password is still valid if a temporary password has been sent, but not been used.
			* An original password that was already expired cannot be reset. You need to talk to an administrator.

			== After logging in ==
			Once you're logged in, you can access the wiki pages. Ideally, the wiki administrators have granted you editing rights, so you can start working on the wiki content right away. You'll learn [[Manual:Create pages\|how to create pages]] next.

			<br />

			[[de:Handbuch:Login]]

Manual:Login

Hjing — Mon, 26 Oct 2026 10:37:12 GMT

← Older revision		Revision as of 10:37, 26 October 2026
(One intermediate revision by the same user not shown)
Line 1:		Line 1:
	SFSAFSAFSAF		SFSAFSAFSAF
			dddd



			ddddd

Manual:Login

Margit.link-rodrigue — Mon, 26 Oct 2026 10:36:33 GMT

← Older revision		Revision as of 10:36, 26 October 2026
Line 1:		Line 1:
	~~sdfsafsadf~~		SFSAFSAFSAF

Test:Random

Hjing — Mon, 26 Oct 2026 10:36:19 GMT

Created page with "ddd"

New page

ddd

Manual:Login

Margit.link-rodrigue — Mon, 26 Oct 2026 10:35:26 GMT

← Older revision	Revision as of 10:35, 26 October 2026
Line 1:	Line 1:
		sdfsafsadf

Manual:Wiki basics

Margit.link-rodrigue — Mon, 26 Oct 2026 10:29:17 GMT

← Older revision		Revision as of 10:29, 26 October 2026
Line 1:		Line 1:
	~~<bookshelf src="Book:User manual" />~~
	==The idea==		==The idea==
	[[File:Manual:wikiwiki-shuttle-cropped.jpg\|300x300px\|thumb\|Wikiwiki Shuttle in Hawaii]]A wiki is a web-based tool that allows people to easily add, modify, or delete the content of a web page simply by using a web browser.		[[File:Manual:wikiwiki-shuttle-cropped.jpg\|300x300px\|thumb\|Wikiwiki Shuttle in Hawaii]]A wiki is a web-based tool that allows people to easily add, modify, or delete the content of a web page simply by using a web browser.

	''Wikiwiki'' is Hawaiian and means ''quick''. It describes the idea of creating and sharing content easily and, obviously, very quickly.		''Wikiwiki'' is Hawaiian and means ''quick''. It describes the idea of creating and sharing content easily and, obviously, very quickly.

Manual:Login

Margit.link-rodrigue — Mon, 26 Oct 2026 10:28:08 GMT

Blanked the page

← Older revision		Revision as of 10:28, 26 October 2026
(3 intermediate revisions by the same user not shown)
Line 1:		Line 1:
	~~==Login==~~
	While public wikis usually don't require you to log in to read their content, most company wikis are log-in based, especially if you want to contribute articles. Unless your wiki has a comfort-sign on solution installed, you will see a login screen before you can access the wiki.

	~~When logging in for the first time, you usually have to change your password and [[Manual:Extension/BlueSpicePrivacy\|confirm the privacy policy and the terms of use]] .~~
	~~<br />~~
	~~[[File:Manual:BlueSpice_Login_Screen_en.png\|center\|450x258px\|A typical BlueSpice Login screen\|border]]~~
	<br />By the way: if you want to stay logged in for a while, just check the box ''Keep me logged in''. That way you don't need to re-enter your data every time you visit the wiki. Your login is stored in a browser cookie on your system. If you delete your browser cookies, you have to provide your login information next time you want to use the wiki.

	~~== After logging in ==~~
	Once you're logged in, you can access the wiki pages. Ideally, the wiki administrators have granted you editing rights, so you can start working on the wiki content right away. You'll learn [[Manual:Create pages\|how to create pages]] in the next chapter.

	~~<br />~~
	~~[[en:{{FULLPAGENAME}}]]~~
	~~[[de:Login]]~~

← Older revision		Revision as of 13:35, 30 October 2026
Line 8:		Line 8:
	\|-		\|-
	\|Severity		\|Severity
	\|reported "critical" (CVSS 3.1: 9.8), BlueSpice assessment: '''critical''' (container <code>bluespice/wiki</code> in BlueSpice pro and farm, publicly readable wikis), '''high''' (same, wikis that require a login), '''medium''' (container <code>bluespice/chat</code>), '''low''' (all other containers)<br />		\|reported "critical" (CVSS 3.1: 9.8), BlueSpice assessment: '''critical''' (container <code>bluespice/wiki</code> in BlueSpice pro and farm, publicly readable wikis), '''high''' (same, wikis that require a login), '''medium''' (container <code>bluespice/chat</code>), '''low''' (all other containers)<br />
	CVE-2026-115557: reported "critical" (CVSS 4.0: 9.4), BlueSpice assessment: '''medium''' (containers <code>bluespice/ai</code> and <code>bluespice/chat</code>), not affected (all other containers)		CVE-2026-115557: reported "critical" (CVSS 4.0: 9.4), BlueSpice assessment: '''medium''' (containers <code>bluespice/ai</code> and <code>bluespice/chat</code>), not affected (all other containers)
	\|-		\|-
Line 32:		Line 32:

	==Problem==		==Problem==
	A vulnerability in the Brotli decompression library (publicly known as "Node2Shell") allows an attacker to write beyond a memory buffer by sending specially crafted compressed data. This can crash the program, reveal memory contents and allow the attacker to run code. The library is used by Node.js and by many Linux programs, e.g. the <code>curl</code> library that PHP uses for outgoing HTTP requests. Public exploit code exists for Node.js applications and for PHP applications that download data from web addresses. The US authority CISA lists the vulnerability as actively exploited.		'''CVE-2026-111497:''' A vulnerability in the Brotli decompression library (publicly known as "Node2Shell") allows an attacker to write beyond a memory buffer by sending specially crafted compressed data. This can crash the program, reveal memory contents and allow the attacker to run code. The library is used by Node.js and by many Linux programs, e.g. the <code>curl</code> library that PHP uses for outgoing HTTP requests. Public exploit code exists for Node.js applications and for PHP applications that download data from web addresses. The US authority CISA lists the vulnerability as actively exploited.

	'''CVE-2026-115557:''' The private keys of several intermediate certificates of the certificate authority eMudhra were generated incorrectly and are publicly known. Anyone can create certificates for any website with them. Browsers already block these certificates, but many programs that check certificates only against a list of trusted root certificates still accept them. Python and Node.js, which the AI service and the chat service use, were updated to block them. Older Python versions are safe if their list of trusted root certificates is up to date.		'''CVE-2026-115557:''' The private keys of several intermediate certificates of the certificate authority eMudhra were generated incorrectly and are publicly known. Anyone can create certificates for any website with them. Browsers already block these certificates, but many programs that check certificates only against a list of trusted root certificates still accept them. Python and Node.js, which the AI service and the chat service use, were updated to block them. Older Python versions are safe if their list of trusted root certificates is up to date.
Line 80:		Line 80:
	\|-		\|-
	\| style="vertical-align:middle;text-align:left;" \|Container <code>bluespice/wiki</code> (BlueSpice pro and farm)		\| style="vertical-align:middle;text-align:left;" \|Container <code>bluespice/wiki</code> (BlueSpice pro and farm)
	\| style="vertical-align:middle;text-align:left;" class="col-purple-bg" \|Critical on publicly readable wikis, high on wikis that require a login. The extensions ExternalData (BlueSpice 5.1 and 5.2) and ExternalContent (BlueSpice 5.2) let users load data from any web address into a page. The wiki decompresses this data with the affected library. An attacker who controls a web server can use this to run commands in the wiki container. Public exploit code shows this for a comparable PHP application.		\| style="vertical-align:middle;text-align:left;" class="col-purple-bg" \|'''Critical''' on publicly readable wikis, high on wikis that require a login. The extensions ExternalData (BlueSpice 5.1 and 5.2) and ExternalContent (BlueSpice 5.2) let users load data from any web address into a page. The wiki decompresses this data with the affected library. An attacker who controls a web server can use this to run commands in the wiki container. Public exploit code shows this for a comparable PHP application.

	Unlike the PHP vulnerabilities in [[Security:Security Advisories/BSSA-2026-08\|BSSA-2026-08]], network access to the wiki is not enough. The attacker needs '''read access to the wiki''' itself. On wikis that require a login, only logged-in users can exploit the vulnerability. The main risk is on publicly readable wikis, where no login is needed. Such wikis are rare among BlueSpice installations. In addition, the wiki must be able to connect to the attacker's server on the internet.		Unlike the PHP vulnerabilities in [[Security:Security Advisories/BSSA-2026-08\|BSSA-2026-08]], network access to the wiki is not enough. The attacker needs '''read access to the wiki''' itself. On wikis that require a login, only logged-in users can exploit the vulnerability. The main risk is on publicly readable wikis, where no login is needed. Such wikis are rare among BlueSpice installations. In addition, the wiki must be able to connect to the attacker's server on the internet.
Line 86:		Line 86:
	\|-		\|-
	\| style="vertical-align:middle;text-align:left;" \|Container <code>bluespice/chat</code>		\| style="vertical-align:middle;text-align:left;" \|Container <code>bluespice/chat</code>
	\| style="vertical-align:middle;text-align:left;" class="col-orange-bg" \|Medium. The chat service is not part of standard installations. Its MS Teams connector decompresses incoming requests before it checks whether they come from Microsoft. This connector is not reachable from outside in the default configuration of <code>bluespice-deploy</code>. If you have made it reachable for MS Teams, the risk is high: an attacker without login could possibly run code in the chat container.		\| style="vertical-align:middle;text-align:left;" class="col-orange-bg" \|'''Medium'''. The chat service is not part of standard installations. Its MS Teams connector decompresses incoming requests before it checks whether they come from Microsoft. This connector is not reachable from outside in the default configuration of <code>bluespice-deploy</code>. If you have made it reachable for MS Teams, the risk is high: an attacker without login could possibly run code in the chat container.
	\| style="vertical-align:middle;text-align:left;" \|Do not expose the MS Teams connector, or reject requests with the header <code>Content-Encoding: br</code> in the reverse proxy in front of it.		\| style="vertical-align:middle;text-align:left;" \|Do not expose the MS Teams connector, or reject requests with the header <code>Content-Encoding: br</code> in the reverse proxy in front of it.
	\|-		\|-
	\| style="vertical-align:middle;text-align:left;" \|All other containers, including <code>bluespice/wiki</code> in BlueSpice free		\| style="vertical-align:middle;text-align:left;" \|All other containers, including <code>bluespice/wiki</code> in BlueSpice free
	\| style="vertical-align:middle;text-align:left;" class="col-green-bg" \|Low. These services contain the affected library, but do not decompress data that users can control. Other features of the wiki that download data (e.g. RSS feeds, PageForms, EmbedVideo, Semantic MediaWiki, search) only use addresses set by administrators or internal services. An attack through them is very unlikely, as it would require a compromised service or a rarely used configuration.		\| style="vertical-align:middle;text-align:left;" class="col-green-bg" \|'''Low'''. These services contain the affected library, but do not decompress data that users can control. Other features of the wiki that download data (e.g. RSS feeds, PageForms, EmbedVideo, Semantic MediaWiki, search) only use addresses set by administrators or internal services. An attack through them is very unlikely, as it would require a compromised service or a rarely used configuration.
	\| style="vertical-align:middle;text-align:left;" \|None required. Update with the next maintenance.		\| style="vertical-align:middle;text-align:left;" \|None required. Update with the next maintenance.
	\|-		\|-
	\| style="vertical-align:middle;text-align:left;" \|Container <code>bluespice/ai</code> (CVE-2026-115557)		\| style="vertical-align:middle;text-align:left;" \|Container <code>bluespice/ai</code> (CVE-2026-115557)
	\| style="vertical-align:middle;text-align:left;" class="col-orange-bg" \|Medium. The AI service is not part of standard installations. It sends questions, wiki content and the API key of the AI provider (e.g. Azure OpenAI, OpenAI, Google, IONOS) over encrypted connections. It still accepts the forged certificates. An attacker who can intercept and redirect the network traffic between your server and the AI provider can read the API key and the wiki content and change the answers. Access to the wiki is not required. However, the attacker must control the network path, e.g. a router, DNS or proxy server between your server and the AI provider. This makes an attack difficult. We do not know of any attacks.		\| style="vertical-align:middle;text-align:left;" class="col-orange-bg" \|'''Medium'''. The AI service is not part of standard installations. It sends questions, wiki content and the API key of the AI provider (e.g. Azure OpenAI, OpenAI, Google, IONOS) over encrypted connections. It still accepts the forged certificates. An attacker who can intercept and redirect the network traffic between your server and the AI provider can read the API key and the wiki content and change the answers. Access to the wiki is not required. However, the attacker must control the network path, e.g. a router, DNS or proxy server between your server and the AI provider. This makes an attack difficult. We do not know of any attacks.
	\| style="vertical-align:middle;text-align:left;" \|Disable the AI service until BlueSpice 5.2.8: set <code>AI=false</code> in the <code>.env</code> file and run <code>./bluespice-deploy up -d --remove-orphans</code>. The AI features of the wiki and the chat are not available until then.		\| style="vertical-align:middle;text-align:left;" \|Disable the AI service until BlueSpice 5.2.8: set <code>AI=false</code> in the <code>.env</code> file and run <code>./bluespice-deploy up -d --remove-orphans</code>. The AI features of the wiki and the chat are not available until then.
	\|-		\|-
	\| style="vertical-align:middle;text-align:left;" \|Container <code>bluespice/chat</code> (CVE-2026-115557, same issue in Node.js)		\| style="vertical-align:middle;text-align:left;" \|Container <code>bluespice/chat</code> (CVE-2026-115557, same issue in Node.js)
	\| style="vertical-align:middle;text-align:left;" class="col-orange-bg" \|Medium. Same issue as for the AI service. The chat service accepts the forged certificates on its connections to MS Teams or Slack. An attacker who controls the network path can read and change chat messages and read the access credentials of the connector.		\| style="vertical-align:middle;text-align:left;" class="col-orange-bg" \|'''Medium'''. Same issue as for the AI service. The chat service accepts the forged certificates on its connections to MS Teams or Slack. An attacker who controls the network path can read and change chat messages and read the access credentials of the connector.
	\| style="vertical-align:middle;text-align:left;" \|None. Update to BlueSpice 5.2.7.2, or disable the chat service.		\| style="vertical-align:middle;text-align:left;" \|None. Update to BlueSpice 5.2.7.2, or disable the chat service.
	\|-		\|-
	\| style="vertical-align:middle;text-align:left;" \|All other containers (CVE-2026-115557)		\| style="vertical-align:middle;text-align:left;" \|All other containers (CVE-2026-115557)
	\| style="vertical-align:middle;text-align:left;" class="col-green-bg" \|Not affected. <code>bluespice/wiki</code> and <code>bluespice/search</code> contain Python, but either already reject the forged certificates or make no outgoing connections. The same applies to Node.js and Java in the other containers.		\| style="vertical-align:middle;text-align:left;" class="col-green-bg" \|'''Not affected'''. <code>bluespice/wiki</code> and <code>bluespice/search</code> contain Python, but either already reject the forged certificates or make no outgoing connections. The same applies to Node.js and Java in the other containers.
	\| style="vertical-align:middle;text-align:left;" \|None required.		\| style="vertical-align:middle;text-align:left;" \|None required.
	\|}		\|}