CVE-2026-89261
Received Received - Intake

MoguBlog Elasticsearch Index Management Authentication Bypass

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: VulnCheck

Description
MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogu_search service without authentication, allowing remote attackers to delete, recreate, or alter the blog search index. Attackers can invoke POST endpoints to wipe the entire search index, delete specific documents, or inject malicious index entries, causing search functionality to return incorrect or no results.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89261
EUVD
EUVD-2026-76134

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mogu mogublog *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-89261 is a vulnerability in MoguBlog versions up to 6.2 where Elasticsearch index management endpoints in the mogu_search service lack authentication. Attackers can remotely delete, recreate, or alter the blog search index without credentials. Exploits target endpoints like /search/initElasticSearchIndex, /search/deleteElasticSearchByUids, and /search/addElasticSearchIndexByUid to disrupt search functionality or inject malicious data.

Detection Guidance

Check if the vulnerable endpoints are accessible without authentication by sending POST requests to /search/addElasticSearchIndexByUid, /search/deleteElasticSearchByUids, /search/deleteElasticSearchByUid, or /search/initElasticSearchIndex. Use curl commands like: curl -X POST http://<target>/search/addElasticSearchIndexByUid -d 'uid=test123' or curl -X POST http://<target>/search/initElasticSearchIndex. If responses indicate success without credentials, the system is vulnerable.

Impact Analysis

This vulnerability allows attackers to delete or corrupt the blog search index, causing search results to return incorrect or no data. Attackers could also inject malicious entries into the index, manipulate search outcomes, or completely disable search functionality for the blog. Recovery may require rebuilding the index manually.

Mitigation Strategies

Immediately restrict access to /search/** endpoints by updating WebSecurityConfig.java to require authentication. Block external access to the mogu_search service (default port 8604) via firewall rules. Temporarily disable the vulnerable endpoints if patching is delayed. Monitor logs for suspicious POST requests to /search endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89261. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart