CVE-2026-109174 MoguBlog through 6.2 Credential Disclosure via /oauth/getSystemConfig
Low-privileged users can access system configuration endpoints to steal sensitive credentials like API keys and SMTP passwords.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-109174?
CVE-2026-109174 is a high-severity vulnerability in moxi624 MoguBlog, published on 12 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
MoguBlog through 6.2 contains an information disclosure vulnerability that allows low-privileged front-end users to read system credentials via the getSystemConfig endpoint. Attackers can supply an ordinary reader session token to retrieve unfiltered SystemConfig data, exposing Qiniu and MinIO secret keys and SMTP mailbox passwords.
Weakness: CWE-863
Which versions are affected by CVE-2026-109174?
How do I fix CVE-2026-109174?
No fix has been published for CVE-2026-109174 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-109174 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-109174 exists.
Sources
Also known as GHSA-fp5j-hvqq-c3w5.