CVE-2026-89262

MoguBlog through version 6.2 contains an authorization bypass (CWE-639) in its comment deletion endpoint, which performs ownership checks using comment UIDs and author UIDs supplied in the request body rather than validating against the authenticated principal. Because those identifiers are freely obtainable from unauthenticated comment-listing endpoints, any unauthenticated network attacker can harvest valid UIDs and delete arbitrary comments and their replies. The impact is integrity loss of blog comment data (no confidentiality or availability impact), which explains the high-severity CVSS 4.0 score of 8.7. All deployments of MoguBlog up to and including version 6.2 are affected. No public proof-of-concept, in-the-wild exploitation, or KEV listing is currently known.

What to do: Check whether your MoguBlog deployment is version 6.2 or earlier and apply the vendor patch or upgrade as soon as a fixed release is published. Until then, mitigate by restricting network access to the comment write/deletion endpoints (e.g., via WAF rules or reverse-proxy allowlists), since comment and author UIDs needed for the attack are exposed by unauthenticated listing endpoints. Monitor blog comments for unexplained deletions and watch for vendor advisories confirming a fixed version.