CVE-2026-89262: MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check
Published Sep 11, 2026
·Updated
MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by supplying comment UIDs and author UIDs obtained from unauthenticated listing endpoints.
Affected Software
1 affected component
MoguBlog<=6.2
Event History
Sep 11, 2026
CVE Published
via MITRE·03:25 PM
Data Sourced
via MITRE·03:25 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
An attacker does not need privileges or user interaction. They need comment UIDs and author UIDs, which can be obtained from unauthenticated listing endpoints, then can supply those values in the deletion request body.
2
What content can be affected?
An attacker can delete arbitrary comments, including their replies. The reported impact is integrity loss; confidentiality and availability impacts are not indicated.