PT-2026-22907 · Hallo Welt! Gmbh · Extension:Nsfilerepo+1

CVE-2026-24732 · Publicado 2026-03-04 · Atualizado 2026-03-04

Positive Technologies (AI Summary)

CVSS v4.0

6.6

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:L/U:X

Name of the Vulnerable Software and Affected Versions Hallo Welt! GmbH BlueSpice versions 5.1 through 5.1.5 Hallo Welt! GmbH BlueSpice versions 5.2 through 5.2.0

Description An issue exists in the Extension:NSFileRepo modules of BlueSpice that allows access to functionality not properly constrained by Access Control Lists (ACLs), potentially bypassing electronic locks and access controls. This could lead to unauthorized access to files or directories. The affected versions are 3.0 versions prior to 3.0.5.

Recommendations Update BlueSpice to a version after 5.1.5 Update BlueSpice to a version after 5.2.0 Update Extension:NSFileRepo to version 3.0.5 or later

Correção

Incorrect Permission

Files Accessible to External Parties

Enumeração de Fraquezas

CWE-732

CWE-552

Identificadores relacionados

CVE-2026-24732

Produtos afetados

Bluespice

Extension:Nsfilerepo

Referências · 4

• https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2026-02 · Nota
• https://twitter.com/CVEnew/status/2029191350567223802 · Publicação no Twitter
• https://t.me/CVEtracker/46320 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-24732 · Nota de Segurança