EUVD-2026-75137
GHSA-j82v-59xc-mmxx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-accessible GraphQL endpoint, no auth or interaction required; only confidentiality impacted as exploitation is purely read-only data disclosure.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 (magefan/module-blog-graph-ql) through 2.2.1 allows remote unauthenticated attackers to obtain blog commenter email addresses and internal customer and admin identifiers via a POST request to /graphql.
AnalysisAI
Unauthenticated information disclosure in the Magefan Blog GraphQL extension for Magento 2 (magefan/module-blog-graph-ql, versions through 2.2.1) exposes blog commenter email addresses alongside internal customer and admin identifiers via a simple POST request to the /graphql endpoint. The blogComments GraphQL query resolver fails to enforce authorization checks on sensitive fields, allowing any remote unauthenticated actor to enumerate user data from affected Magento stores. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Magefan Blog GraphQL extension (magefan/module-blog-graph-ql version ≤ 2.2.1) must be installed and active on a Magento 2 store, and the /graphql endpoint must be network-reachable - the default for public storefronts. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately reflects the attack profile: any HTTP client reaching the /graphql endpoint can exploit this without credentials or user interaction, at negligible complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No patched version is explicitly stated in the available advisory data; the vendor product page at https://magefan.com/magento2-blog-extension and Packagist releases for magefan/module-blog-graph-ql should be monitored for a release newer than 2.2.1 that addresses this issue - patch availability is not independently confirmed at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your Magento 2 deployment to confirm whether the Magefan Blog GraphQL extension (magefan/module-blog-graph-ql) is installed and identify its current version. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary
SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Communit
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML E
Multiple directory traversal vulnerabilities in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.
An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which ca
An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Rated high severity (CVSS 8.1), th
Magento LTS is the official OpenMage LTS codebase. Rated high severity (CVSS 7.5), this vulnerability is remotely exploi
PHP remote file inclusion vulnerability in the fetchView function in the Mage_Core_Block_Template_Zend class in Magento
The fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterpri
Cross-site scripting (XSS) vulnerability in Magento E-Commerce Platform 1.9.0.1. Rated medium severity (CVSS 6.1), this
Password reset tokens in Magento CE before 1.9.2.2, and Magento EE before 1.14.2.2 are passed via a GET request and not
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication v
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today