Vulnerability · Published Sep 11, 2026 · Assigned by VulnCheck
CVE-2026-89264MoguBlog through 6.2 Comment Author Spoofing via Request-Body Identity
Medium 4.3
In plain English
A medium-severity authorization bypass via user-controlled key in MoguBlog from moxi624. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.4%top 69.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attributed to any other user. Attackers can supply arbitrary userUid values in the request body to impersonate other accounts including administrators.
Affected products (as reported)
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
References
- C12 - POST /web/comment/add proof of concept exploit
- CommentRestApi.add persists the author uid taken from the request body technical-description
- MoguBlog releases release-notes
- Product product
- VulnCheck Advisory: MoguBlog through 6.2 Comment Author Spoofing via Request-Body Identity third-party-advisory