EUVD-2026-97380
GHSA-926c-q529-62wh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege admin
-
DeliveryObtain victim admin's file/folder uid
-
ExploitPOST uid to /networkDisk/deleteFile or batchDeleteFile
-
ExecutionServer skips admin_uid ownership check
-
ImpactVictim files deleted from storage backend
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires a valid authenticated administrator account on the MoguBlog instance (PR:L) and a deployment with more than one administrator, since the attack deletes a *different* administrator's network-disk files. The attacker must know or enumerate the target's file or folder uid, which is supplied in the POST body to /networkDisk/deleteFile or batchDeleteFile. No user interaction or non-default configuration is needed - the missing admin_uid ownership check in NetworkDiskServiceImpl.deleteFile is present by default across local storage, Qiniu, and MinIO backends. The practical limiter is the authenticated multi-admin prerequisite: single-admin installations have no other admin whose files can be targeted. |
| Impact | This is a genuine but moderate-severity authorization flaw, not a critical priority. The signals are internally consistent: CVSS 4.0 scores it 5.3 (medium) with AV:N/AC:L/PR:L/UI:N and impact limited to integrity and availability (VI:L/VA:L, VC:N), matching CWE-639 (IDOR). Publicly available POC code exists (AnkesKasty/cve-request-poc), which raises practical exploitability, but there is no EPSS score provided and no CISA KEV listing, so there is no evidence of active or widespread exploitation - POC availability is a distinct signal from in-the-wild use. The key limiting factor is PR:L: the attacker must already hold a valid administrator account, so the real-world population of attackers is restricted to multi-administrator deployments where admins are mutually distrusted. One cross-source caveat: the input Tag 'Authentication Bypass' conflicts with both CWE-639 (authorization bypass) and PR:L (authentication is required, not bypassed) - the issue is a horizontal authorization/IDOR flaw among authenticated admins, not an authentication bypass. Net: treat as a medium-priority data-integrity bug for shared-admin MoguBlog instances, not a drop-everything emergency. |
| Exploit ScenarioDerived | A low-trust administrator on a shared MoguBlog instance enumerates or obtains another administrator's file/folder uid and sends a crafted POST to /networkDisk/deleteFile (or batchDeleteFile) supplying that uid. Because NetworkDiskServiceImpl.deleteFile never validates the uid against the caller's admin_uid, the victim's objects are deleted from local storage, Qiniu, or MinIO. A public POC (poc_networkDisk_ownership.py) demonstrates the ownership bypass, and the low attack complexity (AC:L, no user interaction) makes it reliable once an admin session is held. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
MoguBlog through 6.2 fails to bind network-disk delete operations to the requesting administrator's own account, allowing any authenticated administrator to destroy files and folders belonging to other administrators by submitting their file or folder uid to POST /networkDisk/deleteFile or /networkDisk/batchDeleteFile. The impact is limited to integrity and availability of stored objects (no confidentiality loss) and is constrained by the requirement that the instance has more than one administrator account and that the attacker knows or can enumerate the victim's uid; the exploit is authenticated (PR:L per the assessed vector), requires no user interaction, and works against all three supported storage backends (local disk, Qiniu, MinIO). Publicly available exploit code exists, but there is no indication of confirmed active exploitation, and the severity is moderate rather than critical. A single-administrator deployment has no other admin whose files could be targeted, which materially limits real-world exposure.
RemediationAI
No vendor-released patch was identified at the time of analysis, so the primary recourse is a code-level fix: in NetworkDiskServiceImpl.deleteFile (and the batch-delete path), look up the target object and reject the request unless its admin_uid matches the authenticated administrator's uid - returning 403 explicitly - before delegating to local, Qiniu, or MinIO storage deletion; administrators should track the upstream repository (moxi624/mogu_blog_v2) for a released version addressing CVE-2026-109176 and consult the VulnCheck advisory at https://www.vulncheck.com/advisories/mogublog-through-6.2-idor-allows-deleting-other-administrators-network-disk-files. Until then, deployable compensating controls include enabling versioning or soft-delete/retention on the backing object storage (MinIO bucket versioning, Qiniu versioning or lifecycle retention, filesystem snapshots) so that illicit deletions become recoverable - accepting the trade-off of higher storage consumption and recovery latency; restricting the /networkDisk/deleteFile and /networkDisk/batchDeleteFile endpoints in a reverse proxy or WAF to a small set of trusted administrator IPs, at the cost of blocking legitimate remote admin usage; and consolidating the instance onto a single administrator account or otherwise constraining the number of admin principals, which removes the cross-account attack surface entirely but may conflict with existing operational roles. Logging and alerting on delete calls with uids that do not match the caller's own objects provides detection only and does not prevent destruction, and blocking the endpoints outright disables a legitimate admin feature, so these should be treated as stopgaps rather than fixes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is an insecure direct object reference (CWE-639, authorization bypass through user-controlled key) in the network-disk feature of MoguBlog, a Spring Boot-based Java blogging platform. The REST layer (NetworkDiskRestApi.java, roughly lines 97-120 in the referenced commit) accepts a caller-supplied uid for delete and batch-delete requests and forwards it to NetworkDiskServiceImpl.deleteFile (roughly lines 134-231), whose implementation removes the referenced object without ever comparing the object's owning admin_uid against the authenticated administrator's identity. Because the ownership check is simply absent rather than misconfigured, the flaw is present by default in every deployment and is independent of the storage abstraction: the service deletes the backing object from local storage, Qiniu cloud storage, or MinIO S3-compatible storage using the same unvalidated uid. The deployed CVSS 4.0 vector scores the issue at 5.3 with PR:L/UI:N and low integrity and availability impact, which the independent assessment restates as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L - a genuine but moderate-severity broken access control issue, not a critical one, with the practical limiter being the authenticated multi-administrator prerequisite rather than any technical mitigation.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Network-reachable endpoint (AV:N/AC:L) requiring an authenticated admin account (PR:L); file deletion harms integrity and availability (I:L/A:L) with no data disclosure (C:N).
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, which NetworkDiskServiceImpl.deleteFile never checks against admin_uid, removing stored objects from local storage, Qiniu or MinIO.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB