CVE-2026-89265 moxi624 CVE debrief

Who should care

Defenders responsible for MoguBlog deployments, particularly those using version 6.2 or earlier, should assess exposure and verify patching to prevent potential unauthorized access to image-category records.

Why it matters

CVE-2026-89265 is a medium-severity authorization bypass vulnerability in MoguBlog that allows authenticated users to retrieve restricted image-category records. Defenders should assess exposure, verify patching, and monitor for potential unauthorized access.

• Potential data exposure due to unauthorized access to image-category records.
• Need for verification of patching to prevent exploitation.
• Potential impact on confidentiality due to access to sensitive metadata.
• Requires monitoring for unauthorized access attempts.

Technical summary

The vulnerability is caused by the omission of the @AuthorityVerify annotation in the POST /pictureSort/getPictureSortByUid endpoint, allowing authenticated back-office users without image-category permissions to supply a category uid and retrieve restricted image-category records, including metadata such as name, cover file uid, sort order, and timestamps. The vulnerability has a medium CVSS score of 5.3 and is considered a medium priority for defenders to assess exposure and verify patching. The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. Defenders should assess exposure, verify patching, and monitor for potential unauthorized

Defensive priority

Medium priority for defenders to assess exposure and verify patching, given the medium CVSS score and potential for data exposure.

Recommended defensive actions

• Assess exposure by verifying if MoguBlog version 6.2 or earlier is in use.
• Verify patching by checking if the fix for the authorization bypass vulnerability has been applied.
• Restrict access to the affected endpoint for users without image-category permissions.
• Monitor for potential unauthorized access to image-category records.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the corpus does not establish versions beyond 6.2, exploitation, impact, or remediation, requiring verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.