Vulnerability · Published Sep 11, 2026 · Assigned by VulnCheck
CVE-2026-89262MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check
High 7.5
In plain English
A high-severity authorization bypass via user-controlled key in MoguBlog from moxi624. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 54.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by supplying comment UIDs and author UIDs obtained from unauthenticated listing endpoints.
Affected products (as reported)
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- C04 - POST /web/comment/delete proof of concept exploit
- CommentRestApi.deleteBatch compares the stored author uid against a request-body field technical-description
- mogu_web WebSecurityConfig permits /web/comment/** for all callers technical-description
- MoguBlog releases release-notes
- Product product
- VulnCheck Advisory: MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check third-party-advisory