CVE-2026-89261
MoguBlog through 6.2 Missing Authentication for Elasticsearch Index Management Endpoints
- State
- Published
- Severity
- 6.9 Medium
- Published
- Sep 11, 2026
- Updated
- Sep 24, 2026
- Reserved
- Sep 11, 2026
Description
MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogu_search service without authentication, allowing remote attackers to delete, recreate, or alter the blog search index. Attackers can invoke POST endpoints to wipe the entire search index, delete specific documents, or inject malicious index entries, causing search functionality to return incorrect or no results.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L | VulnCheck |
Weaknesses
- CWE-306 Missing Authentication for Critical Function
Affected Products
| Product | Versions |
|---|---|
MoguBlogmoxi624 |
|
References
- C05 - POST /search/initElasticSearchIndex proof of conceptexploit
- C06 - POST /search/deleteElasticSearchByUids proof of conceptexploit
- C07 - POST /search/deleteElasticSearchByUid proof of conceptexploit
- C11 - POST /search/addElasticSearchIndexByUid proof of conceptexploit
- ElasticSearchRestApi index management endpoints carry no authentication checktechnical-description
- mogu_search WebSecurityConfig permits /search/** for all callerstechnical-description
- MoguBlog releasesrelease-notes
- Productproduct
- VulnCheck Advisory: MoguBlog through 6.2 Missing Authentication for Elasticsearch Index Management Endpointsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.