CVE-2026-89262CWE-639

CVE-2026-89262

High · published September 11, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
44.7
In the wild
Unconfirmed
What it is

MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by supplying comment UIDs and author UIDs obtained from unauthenticated listing endpoints.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00540 · 44.7th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-11T20:17Z
References (6)
https://gitee.com/moxi159753/mogu_blog_v2/releases · [email protected]https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C04_comment_delete_idor.py · [email protected]https://github.com/moxi624/mogu_blog_v2 · [email protected]https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_web/src/main/java/com/moxi/mogublog/web/config/WebSecurityConfig.java · [email protected]https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_web/src/main/java/com/moxi/mogublog/web/restapi/CommentRestApi.java · [email protected]https://www.vulncheck.com/advisories/mogublog-through-6.2-arbitrary-comment-deletion-via-request-body-ownership-check · [email protected]
EPSS history
Timeline
  • 13 SEP 03:23Z
    EPSS moved — → 0%
    epss
  • 11 SEP 15:25Z
    MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check
    cvelistv5