CVE-2026-89264: MoguBlog through 6.2 Comment Author Spoofing via Request-Body Identity
MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attributed to any other user. Attackers can supply arbitrary userUid values in the request body to impersonate other accounts including administrators.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and able to submit a request to the POST /web/comment/add endpoint. No user interaction from the impersonated account is required.
What access or configuration is required for exploitation?
The attacker needs only low-privileged authenticated access and must be able to control the userUid value in the comment request body. The available information does not identify any configuration requirement or mitigation that disables the affected behavior.
What is the practical impact?
An authenticated user can create comments that appear to have been authored by another account, including an administrator. The reported impact is integrity loss; no confidentiality or availability impact is specified.
How can defenders look for attempted or successful exploitation?
Review comment-creation requests and associated records for userUid values that do not match the authenticated user submitting the request. Comments attributed to privileged or unrelated accounts should be investigated against request logs and session identity data.