Login Request a demo
Medium severity · published Sep 11, 2026
CVE-2026-89263
MoguBlog through 6.2 Missing Authentication on the Comment Email-Notification Endpoint
5.3
CVSS
0.5%
EPSS
No
On KEV
Description
MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. Remote callers can modify the startEmailNotification flag in Redis cache for any user identifier to suppress reply notifications without authorization.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
MoguBlog · moxi624
through 6.2 · source: vendor
Affected product
MO
MoguBlog
moxi624
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-89263
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-89263
gitee.com
https://gitee.com/moxi159753/mogu_blog_v2/releases
github.com
https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C08_comment_closeEmailNotification.py
github.com
https://github.com/moxi624/mogu_blog_v2
github.com
https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_web/src/main/java/com/moxi/mogublog/web/config/WebSecurityConfig.java
github.com
https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_web/src/main/java/com/moxi/mogublog/web/restapi/CommentRestApi.java
www.vulncheck.com
https://www.vulncheck.com/advisories/mogublog-through-6.2-missing-authentication-on-the-comment-email-notification-endpoint
More from MoguBlog
7.5
CVE-2026-89262
MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check
7.5
CVE-2026-89260
MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint
6.5
CVE-2026-109174
MoguBlog through 6.2 Credential Disclosure via /oauth/getSystemConfig
6.5
CVE-2026-89261
MoguBlog through 6.2 Missing Authentication for Elasticsearch Index Management Endpoints
5.4
CVE-2026-109176
MoguBlog through 6.2 IDOR Allows Deleting Other Administrators' Network-Disk Files