← Database

CVE-2026-89264

MEDIUM CVSS: 4.3 Published: 2026-09-11 Modified: 2026-09-11

Description

MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attributed to any other user. Attackers can supply arbitrary userUid values in the request body to impersonate other accounts including administrators.

Affected Platforms

Unknown

Weakness Type

CWE-639

References