Magefan Blog
Monthly
Unauthenticated information disclosure in the Magefan Blog GraphQL extension for Magento 2 (magefan/module-blog-graph-ql, versions through 2.2.1) exposes blog commenter email addresses alongside internal customer and admin identifiers via a simple POST request to the /graphql endpoint. The blogComments GraphQL query resolver fails to enforce authorization checks on sensitive fields, allowing any remote unauthenticated actor to enumerate user data from affected Magento stores. No active exploitation is confirmed in CISA KEV, but SSVC rates the attack as automatable, and a researcher gist publicly documenting the issue is included in the references.
Unauthenticated information disclosure in the Magefan Blog GraphQL extension for Magento 2 (magefan/module-blog-graph-ql, versions through 2.2.1) exposes blog commenter email addresses alongside internal customer and admin identifiers via a simple POST request to the /graphql endpoint. The blogComments GraphQL query resolver fails to enforce authorization checks on sensitive fields, allowing any remote unauthenticated actor to enumerate user data from affected Magento stores. No active exploitation is confirmed in CISA KEV, but SSVC rates the attack as automatable, and a researcher gist publicly documenting the issue is included in the references.