CVE-2026-89263
MoguBlog through 6.2 Missing Authentication on the Comment Email-Notification Endpoint
- State
- Published
- Severity
- 6.9 Medium
- Published
- Sep 11, 2026
- Updated
- Sep 24, 2026
- Reserved
- Sep 11, 2026
Description
MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. Remote callers can modify the startEmailNotification flag in Redis cache for any user identifier to suppress reply notifications without authorization.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | VulnCheck |
Weaknesses
- CWE-306 Missing Authentication for Critical Function
Affected Products
| Product | Versions |
|---|---|
MoguBlogmoxi624 |
|
References
- C08 - GET /web/comment/closeEmailNotification/{userUid} proof of conceptexploit
- CommentRestApi.bindUserEmail takes the target user from the path with no authorization checktechnical-description
- mogu_web WebSecurityConfig permits /web/comment/** for all callerstechnical-description
- MoguBlog releasesrelease-notes
- Productproduct
- VulnCheck Advisory: MoguBlog through 6.2 Missing Authentication on the Comment Email-Notification Endpointthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.