Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-89264

MoguBlog through 6.2 Comment Author Spoofing via Request-Body Identity

CVSS 3.1 4.3 MEDIUMCVSS 4.0 5.3 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-89264

Published

MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attributed to any other user. Attackers can supply arbitrary userUid values in the request body to impersonate other accounts including administrators.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-89264

Published

MoguBlog

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "vendor": "moxi624",
                    "product": "MoguBlog",
                    "packageURL": "pkg:github/moxi624/mogu_blog_v2",
                    "repo": "https://github.com/moxi624/mogu_blog_v2",
                    "versions": [
                        {
                            "version": "0",
                            "lessThanOrEqual": "6.2",
                            "status": "affected",
                            "versionType": "custom"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON