Vulnerability · Published Sep 11, 2026 · Assigned by VulnCheck

CVE-2026-89261MoguBlog through 6.2 Missing Authentication for Elasticsearch Index Management Endpoints

Medium 6.5

In plain English

A medium-severity missing authentication in MoguBlog from moxi624. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.8%top 42.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogu_search service without authentication, allowing remote attackers to delete, recreate, or alter the blog search index. Attackers can invoke POST endpoints to wipe the entire search index, delete specific documents, or inject malicious index entries, causing search functionality to return incorrect or no results.

Affected products (as reported)

Vendor	Product	Versions
moxi624	MoguBlog	0 – through 6.2

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

References

C05 - POST /search/initElasticSearchIndex proof of concept exploit
C06 - POST /search/deleteElasticSearchByUids proof of concept exploit
C07 - POST /search/deleteElasticSearchByUid proof of concept exploit
C11 - POST /search/addElasticSearchIndexByUid proof of concept exploit
ElasticSearchRestApi index management endpoints carry no authentication check technical-description
mogu_search WebSecurityConfig permits /search/** for all callers technical-description
MoguBlog releases release-notes
Product product
VulnCheck Advisory: MoguBlog through 6.2 Missing Authentication for Elasticsearch Index Management Endpoints third-party-advisory