CVE-2026-89263CWE-306

CVE-2026-89263

Medium · published September 11, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
38.3
In the wild
Unconfirmed
What it is

MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. Remote callers can modify the startEmailNotification flag in Redis cache for any user identifier to suppress reply notifications without authorization.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00452 · 38.3th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-09-11T20:17Z
References (6)
https://gitee.com/moxi159753/mogu_blog_v2/releases · [email protected]https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C08_comment_closeEmailNotification.py · [email protected]https://github.com/moxi624/mogu_blog_v2 · [email protected]https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_web/src/main/java/com/moxi/mogublog/web/config/WebSecurityConfig.java · [email protected]https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_web/src/main/java/com/moxi/mogublog/web/restapi/CommentRestApi.java · [email protected]https://www.vulncheck.com/advisories/mogublog-through-6.2-missing-authentication-on-the-comment-email-notification-endpoint · [email protected]
EPSS history
Timeline
  • 13 SEP 03:23Z
    EPSS moved — → 0%
    epss
  • 11 SEP 15:25Z
    MoguBlog through 6.2 Missing Authentication on the Comment Email-Notification Endpoint
    cvelistv5