CVE-2026-89262
Received Received - Intake

Authorization Bypass in MoguBlog Comment Deletion

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: VulnCheck

Description
MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by supplying comment UIDs and author UIDs obtained from unauthenticated listing endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89262
EUVD
EUVD-2026-76135

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
mogublog mogublog to 6.2 (inc)
mogu blog to 6.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-89262 is an authorization bypass flaw in MoguBlog versions up to 6.2. The vulnerability allows attackers to delete any comment or its replies by manipulating request-body fields instead of using the authenticated user's identity. The issue occurs because the comment deletion endpoint checks ownership based on user-controlled data rather than the actual logged-in user.

Detection Guidance

To detect this vulnerability, check if unauthenticated users can access comment listing endpoints like /web/comment/getList and retrieve comment UIDs and author UIDs. Verify if the /web/comment/delete endpoint allows deletion without proper ownership validation by sending requests with arbitrary userUid values.

Impact Analysis

This vulnerability enables attackers to delete arbitrary comments without authentication, potentially removing legitimate user content, replies, or moderator posts. It could disrupt blog functionality, damage reputation, or be used for vandalism. The impact includes loss of data visibility and potential misuse of soft-delete features.

Mitigation Strategies

Immediately update MoguBlog to a patched version beyond 6.2. If an update is unavailable, restrict access to /web/comment/** endpoints to authenticated users only and implement proper ownership validation in the deleteBatch method. Review logs for unauthorized comment deletions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89262. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart