CVE-2026-89265 — MoguBlog through 6.2 Missing Authorization on the Admin getPictureSortByUid Endpoint
MoguBlog through 6.2 contains an authorization bypass vulnerability in the POST /pictureSort/getPictureSortByUid endpoint, which omits the @AuthorityVerify annotation required t…
Published: 2026-09-11 · CVSS: 5.3 · CVSS 4.0
MoguBlog through 6.2 contains an authorization bypass vulnerability in the POST /pictureSort/getPictureSortByUid endpoint, which omits the @AuthorityVerify annotation required to enforce role-based permissions. Authenticated back-office users without image-category permissions can supply a category uid to retrieve restricted image-category records including metadata such as name, cover file uid, sort order and timestamps.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7