What’s Vulnerable › Vulnerabilities

CVE-2026-89264: MoguBlog through 6.2 Comment Author Spoofing via Request-Body Identity

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-11 · updated 2026-09-11
• Weakness: CWE-639

Description

MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attributed to any other user. Attackers can supply arbitrary userUid values in the request body to impersonate other accounts including administrators.

Affected products

• moxi624 MoguBlog: through 6.2

References

• https://gitee.com/moxi159753/mogu_blog_v2/releases
• https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C12_comment_add_author_spoof.py
• https://github.com/moxi624/mogu_blog_v2
• https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_web/src/main/java/com/moxi/mogublog/web/restapi/CommentRestApi.java
• https://www.vulncheck.com/advisories/mogublog-through-6.2-comment-author-spoofing-via-request-body-identity

Get alerted when CVE-2026-89264 or the next vulnerability affects your stack