EUVD-2026-76138
GHSA-jgmr-fg2f-g83q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible admin endpoint requires valid session (PR:L); only limited metadata disclosed (C:L); no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
5DescriptionCVE.org
MoguBlog through 6.2 contains an authorization bypass vulnerability in the POST /pictureSort/getPictureSortByUid endpoint, which omits the @AuthorityVerify annotation required to enforce role-based permissions. Authenticated back-office users without image-category permissions can supply a category uid to retrieve restricted image-category records including metadata such as name, cover file uid, sort order and timestamps.
AnalysisAI
Missing authorization on a MoguBlog admin-backend endpoint allows authenticated back-office users to retrieve image-category records beyond their assigned role permissions. The POST /pictureSort/getPictureSortByUid handler in versions through 6.2 omits the @AuthorityVerify annotation that enforces role-based access control, making it a classic Broken Function Level Authorization (BFLA) flaw. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session in the MoguBlog admin back-office (PR:L per CVSS vector) - unauthenticated external access is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 3.1 scores this at 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, which accurately reflects the constrained real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary comment deletion in MoguBlog through 6.2 allows remote attackers to permanently remove any com
Unauthenticated XML external entity injection in MoguBlog through version 6.2 allows remote attackers to read arbitrary
Unauthenticated integrity manipulation in MoguBlog through 6.2 allows any remote caller to silently disable email reply
Unauthenticated access to Elasticsearch index management endpoints in MoguBlog's mogu_search microservice (through versi
A vulnerability, which was classified as problematic, has been found in moxi624 Mogu Blog v2 up to 5.2. Rated medium sev
Mogu blog 5.2 is vulnerable to Cross Site Scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is remot
Server-side request forgery in Mogu Blog v2 up to version 5.2 allows remote, unauthenticated attackers to force the serv
Comment author spoofing in MoguBlog through version 6.2 allows any authenticated user to post comments attributed to arb
Missing authorization in the Storage Management Endpoint of Mogu Blog v2 (up to version 5.2) enables unauthenticated rem
Authenticated path traversal in Mogu Blog v2 up to 5.2 allows remote attackers to write files to arbitrary directories v
Unrestricted file upload in Mogu Blog v2 up to version 5.2 allows remote attackers with low privileges to upload arbitra
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today