CVE-2026-89264
Received Received - Intake

Authenticated Comment Impersonation in MoguBlog

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: VulnCheck

Description
MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attributed to any other user. Attackers can supply arbitrary userUid values in the request body to impersonate other accounts including administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89264
EUVD
EUVD-2026-76137

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mogublog mogublog to 6.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in MoguBlog through version 6.2 allows authenticated users to post comments under any other user's identity, including administrators. The flaw occurs because the application fails to validate the comment author identity in the POST /web/comment/add endpoint. Attackers can manipulate the request body to supply arbitrary userUid values, enabling impersonation without detection.

Detection Guidance

To detect this vulnerability, monitor POST requests to /web/comment/add endpoints for userUid values that do not match the authenticated session's userUid. Check if comments are posted under unexpected user identities. Use network traffic analysis tools like Wireshark or tcpdump to inspect HTTP requests for manipulated userUid fields.

Impact Analysis

An attacker could impersonate you or other users, posting comments under your name. This could lead to reputational damage, misinformation spread, or unauthorized actions performed through your account. Additionally, the impersonated user may receive reply notifications, potentially exposing sensitive information or enabling further social engineering attacks.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized data access or impersonation, which may breach integrity and accountability principles in GDPR and HIPAA. Specifically, it risks unauthorized disclosure of personal data through spoofed comments and undermines audit trails by allowing actions to appear as if performed by another user.

Mitigation Strategies

Immediately update MoguBlog to the latest version beyond 6.2. Implement strict input validation to ensure userUid values in POST requests match the authenticated session's userUid. Disable comment functionality temporarily if an update is not immediately available. Monitor logs for suspicious comment activity or unauthorized userUid modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89264. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart