MoguBlog CVE-2026-109174

Requires a valid low-privileged front-end reader session token for the target MoguBlog instance - i.e., the attacker must hold or obtain an ordinary registered reader account, which is typically self-service on public blogs. No elevated privileges, admin access, or user interaction are needed beyond that token, and the getSystemConfig endpoint returns unfiltered SystemConfig over the network. Practical impact is limited to deployments that have actually configured Qiniu/MinIO object storage or SMTP mail, since those are the secrets exposed; an instance with none of these integrations configured leaks correspondingly less. The authentication (reader-account) requirement is the primary limiting factor distinguishing this from a fully unauthenticated leak.

This is a genuine, easily-actionable confidentiality issue rather than an inflated high-CVSS theoretical. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) indicates a network-reachable attack of low complexity requiring only low privileges and no user interaction, with high confidentiality impact and no integrity or availability impact - consistent with the description of a reader-level account dumping unfiltered SystemConfig. A publicly available POC (poc_oauth_getSystemConfig.py) materially raises practical exploitability: the barrier is reduced to possessing any ordinary reader session token, which on a public blog is typically trivial to obtain via self-registration. Countervailing signals: this is NOT in CISA KEV, so there is no confirmed active exploitation, and no EPSS score was provided in the input to gauge exploitation probability in the wild - treat widespread automated exploitation as unconfirmed. The CWE-863 (incorrect authorization) classification aligns with the described behavior and conflicts with the 'Authentication Bypass' tag: the attacker uses a valid (low-privileged) session, so this is broken authorization/privilege enforcement, not authentication bypass - verify tag before using it for correlation. Net: a real, high-priority credential-exposure bug for anyone actually running MoguBlog, tempered by its niche deployment footprint and the authentication (reader account) prerequisite.

An attacker self-registers or otherwise obtains an ordinary front-end reader account on a MoguBlog site and authenticates to get a session token. Using the token (as demonstrated by the public POC), they call the getSystemConfig endpoint, which returns unfiltered SystemConfig and exposes Qiniu and MinIO object-storage secret keys plus SMTP mailbox passwords. The attacker then abuses those harvested credentials to access/modify cloud storage buckets and send mail as the victim, pivoting well beyond the blog itself.