Security:Security Advisories/BSSA-2026-01

Date	2026-01-29
Severity	reported "high", BlueSpice assessment: low
Affected	Services in current LTS version < 5.1.4
Fixed in	5.2.1, 5.1.5
CVE	CVE-2025-14847

Problem

• Service collabpads-backend (image name: mongo ) - CVE-2025-14847

Impact assessment

• Service collabpads-backend (image name: mongo )
  • A unauthenticated MongoDB client can attack the service if reachable. By default BlueSpice setup, the service runs only in the background and can not be accessed from outside the virtual network. So not even unauthenticated access is possible from any external location.

Solution

To mitigate CVE-2025-14847 use one of the following options:

1. make sure the service has no access to the internet. This is the default configuration of BlueSpice setups.
2. Update the mongo docker image via BlueSpice's deploy tool: bluespice-deploy mongo pull && bluespice-deploy up -d
3. Update to version >=5.1.5 or >=5.2.1 of the BlueSpice images