CVE-2026-89263: MoguBlog through 6.2 Missing Authentication on the Comment Email-Notification Endpoint
MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. Remote callers can modify the startEmailNotification flag in Redis cache for any user identifier to suppress reply notifications without authorization.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Require proper authentication/authorization for requests to the /web/comment/closeEmailNotification endpoint; ensure unauthenticated callers cannot modify the startEmailNotification flag in the Redis cache for arbitrary user identifiers.
MoguBlog through 6.2 startEmailNotification = prevent unauthenticated modification (require authentication/authorization before changing Redis-backed flag)
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote caller able to reach the affected MoguBlog endpoint can exploit it. No account, privileges, or user interaction are required.
What is the impact of a successful exploit?
An attacker can disable reply email notifications for arbitrary users by modifying the startEmailNotification flag associated with a user identifier in Redis cache. The stated impact is suppression of notifications; no confidentiality or availability impact is indicated.
Which deployments are affected?
MoguBlog through version 6.2 is identified as affected. The issue concerns the /web/comment/closeEmailNotification endpoint.
How can I determine whether an instance is exposed?
Check whether the application exposes /web/comment/closeEmailNotification to unauthenticated requests. An exposed instance is vulnerable if such requests can alter the Redis-backed startEmailNotification setting for user identifiers without authentication.