CVE-2026-79323

CVE-2026-79323 is an information disclosure flaw (CWE-200) in the blogComments GraphQL query of the Magefan Blog GraphQL extension (magefan/module-blog-graph-ql) for Magento 2. A remote, unauthenticated attacker can send a POST request to the store's /graphql endpoint invoking the blogComments query, which returns more data than it should. The attacker gains blog commenters' email addresses along with internal customer and admin account identifiers, with no privileges or user interaction required (CVSS 3.1: 7.5, high confidentiality impact). Any Magento 2 store running this module in version 2.2.1 or earlier is affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known as of publication.

What to do: Update magefan/module-blog-graph-ql to the first patched release after 2.2.1 (check Magefan's changelog) and deploy it with a standard composer update and cache flush. As an interim mitigation, restrict or disable unauthenticated access to the blogComments GraphQL query (e.g., via GraphQL introspection/field controls or edge rules) so commenter email addresses are not returned. Review web logs for unauthenticated POSTs to /graphql invoking blogComments and consider notifying commenters whose email addresses may have been exposed.