CVE-2026-109176Published

MoguBlog through 6.2 IDOR Allows Deleting Other Administrators' Network-Disk Files

Explicit identifiers and source references

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-109176 · Microsoft / collected KEV context

cve-program · CVE-2026-109176

https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/mogu_blog_v2/poc_networkDisk_ownership.py
https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_picture/src/main/java/com/moxi/mogublog/picture/restapi/NetworkDiskRestApi.java#L97-L120
https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_picture/src/main/java/com/moxi/mogublog/picture/service/impl/NetworkDiskServiceImpl.java#L134-L231
https://www.vulncheck.com/advisories/mogublog-through-6.2-idor-allows-deleting-other-administrators-network-disk-files

Related operational evidence

Explicit CVE identifiers

No related operational record is retained in the current change model.