CVE-2026-89265 Details
Description
MoguBlog through 6.2 contains an authorization bypass vulnerability in the POST /pictureSort/getPictureSortByUid endpoint, which omits the @AuthorityVerify annotation required to enforce role-based permissions. Authenticated back-office users without image-category permissions can supply a category uid to retrieve restricted image-category records including metadata such as name, cover file uid, sort order and timestamps.
An authorization bypass vulnerability has been identified in MoguBlog versions through 6.2. The issue resides in the POST /pictureSort/getPictureSortByUid endpoint, which fails to include the necessary @AuthorityVerify annotation for enforcing role-based permissions. This oversight allows authenticated back-office users without image-category permissions to provide a category UID and access restricted image-category records. The retrieved records include metadata such as the category name, cover file UID, sort order, and timestamps.
To address this vulnerability, add the @AuthorityVerify annotation to the getPictureSortByUid method in the PictureSortRestApi controller. Additionally, review and audit the other methods in the controller that lack this annotation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 11, 2026CISA-ADP
Assessed Sep 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MoguBlog | <= 6.2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 11, 2026 | CVE Modified | CISA-ADP |
| Sep 11, 2026 | New CVE Received | [email protected] |