Medium severity · published Sep 11, 2026
CVE-2026-89264
MoguBlog through 6.2 Comment Author Spoofing via Request-Body Identity
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attributed to any other user. Attackers can supply arbitrary userUid values in the request body to impersonate other accounts including administrators.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
MoguBlog · moxi624
through 6.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-89264
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-89264
gitee.com
https://gitee.com/moxi159753/mogu_blog_v2/releases
github.com
https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C12_comment_add_author_spoof.py
github.com
https://github.com/moxi624/mogu_blog_v2
github.com
https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_web/src/main/java/com/moxi/mogublog/web/restapi/CommentRestApi.java
www.vulncheck.com
https://www.vulncheck.com/advisories/mogublog-through-6.2-comment-author-spoofing-via-request-body-identity
More from MoguBlog
7.5
CVE-2026-89262
MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check
7.5
CVE-2026-89260
MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint
6.5
CVE-2026-109174
MoguBlog through 6.2 Credential Disclosure via /oauth/getSystemConfig
6.5
CVE-2026-89261
MoguBlog through 6.2 Missing Authentication for Elasticsearch Index Management Endpoints
5.4
CVE-2026-109176
MoguBlog through 6.2 IDOR Allows Deleting Other Administrators' Network-Disk Files