Medium severity · published Sep 11, 2026
CVE-2026-89261
MoguBlog through 6.2 Missing Authentication for Elasticsearch Index Management Endpoints
6.5
CVSS
0.8%
EPSS
No
On KEV
Description
MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogu_search service without authentication, allowing remote attackers to delete, recreate, or alter the blog search index. Attackers can invoke POST endpoints to wipe the entire search index, delete specific documents, or inject malicious index entries, causing search functionality to return incorrect or no results.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
MoguBlog · moxi624
through 6.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-89261
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-89261
gitee.com
https://gitee.com/moxi159753/mogu_blog_v2/releases
github.com
https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C05_search_initElasticSearchIndex.py
github.com
https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C06_search_deleteElasticSearchByUids.py
github.com
https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C07_search_deleteElasticSearchByUid.py
github.com
https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C11_search_addElasticSearchIndexByUid.py
github.com
https://github.com/moxi624/mogu_blog_v2
More from MoguBlog
7.5
CVE-2026-89262
MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check
7.5
CVE-2026-89260
MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint
6.5
CVE-2026-109174
MoguBlog through 6.2 Credential Disclosure via /oauth/getSystemConfig
5.4
CVE-2026-109176
MoguBlog through 6.2 IDOR Allows Deleting Other Administrators' Network-Disk Files
5.3
CVE-2026-89263
MoguBlog through 6.2 Missing Authentication on the Comment Email-Notification Endpoint