CVE-2026-89262 MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check
Attackers can delete arbitrary comments in MoguBlog by spoofing ownership fields in the request body, bypassing authentication checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-89262?
CVE-2026-89262 is a high-severity missing authorization vulnerability in moxi624 MoguBlog, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by supplying comment UIDs and author UIDs obtained from unauthenticated listing endpoints.
Weakness: CWE-639
Which versions are affected by CVE-2026-89262?
How do I fix CVE-2026-89262?
No fix has been published for CVE-2026-89262 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-89262 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-89262 exists.
Sources
Also known as GHSA-7vp6-9cc5-c2c2.