CVE-2026-89262 PUBLISHED

MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check

Assigner: VulnCheck
Reserved: 11.09.2026 Published: 11.09.2026 Updated: 11.09.2026

MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by supplying comment UIDs and author UIDs obtained from unauthenticated listing endpoints.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS Score: 7.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	High
User Interaction	None	Availability Impact	None

CVSS 3.1

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS Score: 8.7

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	None	Confidentiality	None
Attack Complexity	Low	Integrity	High	Integrity	None
Attack Requirements	None	Availability	None	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	moxi624
Product	MoguBlog
Versions	Default: unaffected affected from 0 to 6.2 (incl.)

CVE-2026-89262 PUBLISHED

MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check

Metrics

Product Status

Credits

References

Problem Types