CVE-2026-89265 PUBLISHED

MoguBlog through 6.2 Missing Authorization on the Admin getPictureSortByUid Endpoint

Assigner: VulnCheck
Reserved: 11.09.2026 Published: 11.09.2026 Updated: 11.09.2026

MoguBlog through 6.2 contains an authorization bypass vulnerability in the POST /pictureSort/getPictureSortByUid endpoint, which omits the @AuthorityVerify annotation required to enforce role-based permissions. Authenticated back-office users without image-category permissions can supply a category uid to retrieve restricted image-category records including metadata such as name, cover file uid, sort order and timestamps.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 5.3

Product Status

Vendor moxi624
Product MoguBlog
Versions Default: unaffected
  • affected from 0 to 6.2 (incl.)

Credits

  • Mingsheng Lin reporter

References

Problem Types

  • Missing Authorization CWE