Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck
CVE-2026-109174MoguBlog through 6.2 Credential Disclosure via /oauth/getSystemConfig
Medium 6.5
In plain English
A medium-severity incorrect authorization in MoguBlog from moxi624. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.2%top 85.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
MoguBlog through 6.2 contains an information disclosure vulnerability that allows low-privileged front-end users to read system credentials via the getSystemConfig endpoint. Attackers can supply an ordinary reader session token to retrieve unfiltered SystemConfig data, exposing Qiniu and MinIO secret keys and SMTP mailbox passwords.
Affected products (as reported)
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- Researcher Proof of Concept exploit
- Vulnerable Code technical-description
- VulnCheck Advisory: MoguBlog through 6.2 Credential Disclosure via /oauth/getSystemConfig third-party-advisory