CVE-2026-109175 in MoguBlog
Summary
by MITRE • 10/12/2026
MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POST /networkDisk/getFileList. Attackers can query the endpoint, which filters only by status, file type, or filePath and never by admin_uid, to obtain other administrators' file names and download URLs.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in MoguBlog versions through 6.2 represents a classic Insecure Direct Object Reference (IDOR), formally categorized under CWE-639. This flaw arises from the application's failure to enforce proper authorization checks when processing requests for sensitive resources, specifically network-disk files managed by administrators. The core technical deficiency lies within the POST /networkDisk/getFileList endpoint, which is designed to retrieve a list of files stored on the server's network disk. While this functionality requires authentication and restricts access to users with administrative privileges, it lacks critical object-level authorization controls. Specifically, the backend logic filters file listings based solely on parameters such as status, file type, or filePath, but completely omits any validation against the admin_uid of the requesting user. This architectural oversight means that once an attacker authenticates as a valid administrator, they can manipulate request parameters to enumerate and access files belonging to other administrators without restriction.
From an operational perspective, this vulnerability allows for significant information disclosure within the administrative scope of the application. An authenticated adversary can systematically query the endpoint with varying file paths or types to discover the existence of sensitive documents stored by fellow administrators. The response includes not only the filenames but also direct download URLs, which facilitates further exploitation such as unauthorized data exfiltration or potential supply chain attacks if those files contain source code or configuration secrets. This scenario aligns closely with MITRE ATT&CK technique T1078, Valid Accounts, where an attacker leverages legitimate credentials to access resources they are not authorized to view. The impact extends beyond simple privacy violations; it compromises the integrity and confidentiality of administrative operations within the MoguBlog ecosystem, potentially leading to further system compromise if sensitive configuration files or backup data are accessed.
Mitigation strategies must focus on implementing robust authorization checks at both the application logic and database query levels. Developers should modify the getFileList endpoint to explicitly include the current user's identifier in all resource retrieval queries, ensuring that administrators can only list files associated with their own account ID. This involves binding the admin_uid parameter from the authenticated session context directly into the SQL or NoSQL query used to fetch file metadata, thereby enforcing strict object-level access control. Additionally, implementing a centralized authorization middleware that validates permissions before any business logic is executed would provide a more resilient defense against such flaws. Regular security code reviews and automated static application security testing (SAST) focused on identifying missing authorization checks in API endpoints are recommended practices to prevent similar vulnerabilities in future releases of the software.