23 Oct 2026 15:48:27 UTC
MoguBlog through 6.2 Missing Authorization on the Admin getPictureSortByUid Endpoint
cve-program · CVE-2026-89265 · Published
CVE-2026-89265
MoguBlog through 6.2 Missing Authorization on the Admin getPictureSortByUid Endpoint
CVSS 3.1 4.3 MEDIUMCVSS 4.0 5.3 MEDIUMCheck source for fixed versionsKEV status unknown
Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.
cve-program · CVE-2026-89265
PublishedMoguBlog through 6.2 contains an authorization bypass vulnerability in the POST /pictureSort/getPictureSortByUid endpoint, which omits the @AuthorityVerify annotation required to enforce role-based permissions. Authenticated back-office users without image-category permissions can supply a category uid to retrieve restricted image-category records including metadata such as name, cover file uid, sort order and timestamps.
Read the publisher's advisoryAffected versions, risk and source history
Advisory history
1 saved versionsSee how the publisher's advisory changed over time. Each link opens the version saved at that time. The publisher's update date can differ from the date shown here.
How advisory history works
Each link identifies one complete publisher record. History can include advisories that previously shared an identifier; an identifier removed by a publisher no longer establishes a current relationship. A historical link shows only that record and earlier saved versions. Failed checks and unchanged reads do not create new versions.
This historical link shows only this version and versions saved before it. Browse all advisory history.