CVE-2026-89262 — MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check
MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the au…
Published: 2026-09-11 · CVSS: 8.7 · CVSS 4.0
MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by supplying comment UIDs and author UIDs obtained from unauthenticated listing endpoints.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7