CVE-2026-89263
Received Received - Intake

MoguBlog Unauthenticated Email Notification Disabling via Redis Cache Manipulation

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: VulnCheck

Description
MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. Remote callers can modify the startEmailNotification flag in Redis cache for any user identifier to suppress reply notifications without authorization.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89263
EUVD
EUVD-2026-76136

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
mogublog mogublog to 6.2 (inc)
mogu blog 6.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

MoguBlog through version 6.2 has a missing authentication vulnerability in the /web/comment/closeEmailNotification endpoint. Unauthenticated attackers can send requests to this endpoint with a user identifier to disable email notifications for any user by modifying the startEmailNotification flag in Redis cache without authorization.

Detection Guidance
  • Check if the /web/comment/closeEmailNotification/{userUid} endpoint is accessible without authentication by sending a GET request to it with a valid user UID. Example: curl -v http://<target-ip>:8603/web/comment/closeEmailNotification/<valid_user_uid>
  • Harvest user UIDs from the public /web/comment/getList endpoint which does not require authentication. Example: curl http://<target-ip>:8603/web/comment/getList
  • Test for the NPE vulnerability by sending a GET request with an invalid UID (32 zeros) to /web/comment/closeEmailNotification/00000000000000000000000000000000. A 500 error indicates the UID exists.
Impact Analysis

Attackers can suppress email notifications for users, preventing them from receiving replies to their comments. This could disrupt communication and user engagement on the platform. The vulnerability requires the target user to have existing comments for exploitation.

Mitigation Strategies

Immediately restrict access to the /web/comment/closeEmailNotification/{userUid} endpoint by implementing proper authentication and authorization checks. Update WebSecurityConfig to block unauthenticated access to /web/comment/** paths.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89263. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart