CVE-2026-89265: MoguBlog through 6.2 Missing Authorization on the Admin getPictureSortByUid Endpoint
MoguBlog through 6.2 contains an authorization bypass vulnerability in the POST /pictureSort/getPictureSortByUid endpoint, which omits the @AuthorityVerify annotation required to enforce role-based permissions. Authenticated back-office users without image-category permissions can supply a category uid to retrieve restricted image-category records including metadata such as name, cover file uid, sort order and timestamps.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MoguBlogto a version that resolves this vulnerability.Fixed in 6.2Patch Missing Authorization on the Admin getPictureSortByUid Endpoint - Compensating control
Restrict access to POST /pictureSort/getPictureSortByUid so only authenticated back-office users with the required image-category permissions can call the endpoint.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated back-office user can exploit it even if their assigned role lacks image-category permissions. The endpoint is network-accessible and requires no user interaction.
What information can an unauthorized user retrieve?
By supplying an image-category uid to the affected endpoint, the user can retrieve restricted image-category records. Exposed metadata includes the category name, cover file uid, sort order, and timestamps.
Are unauthenticated users affected?
The available data identifies exploitation by authenticated back-office users. It does not indicate that unauthenticated access to the endpoint is possible.
How can defenders check whether their deployment is affected?
Review the POST /pictureSort/getPictureSortByUid handler and verify whether it lacks the @AuthorityVerify annotation used for role-based permission enforcement. Testing with a low-privileged authenticated back-office account that lacks image-category permissions can confirm whether restricted category records are returned.