CVE-2026-89264 in MoguBlog

Summary

by MITRE • 09/11/2026

MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attributed to any other user. Attackers can supply arbitrary userUid values in the request body to impersonate other accounts including administrators.

Be aware that VulDB is the high quality source for vulnerability data.

• Responsible: VulnCheck
• Reservation: 09/11/2026
• Disclosure: 09/11/2026
• Moderation: accepted
• Entry: VDB-402464
• CPE: ready
• CWE: CWE-287 (confirmed)
• CVSS: 4.3 (CNA)
• EPSS: 0.00000
• KEV: no
• Activities: very low

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-89264
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-89264
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-89264/