CVE-2026-89261: medium-severity vulnerability in moxi624 MoguBlog
MoguBlog through 6.2 Missing Authentication for Elasticsearch Index Management Endpoints
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.9epss 0.8%
MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogu_search service without authentication, allowing remote attackers to delete, recreate, or alter the blog search index. Attackers can invoke POST endpoints to wipe the entire search index, delete specific documents, or inject malicious index entries, causing search functionality to return incorrect or no results.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
moxi624 · MoguBlogpublic PoCs found — 4
cve_referencegithub.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C05_search_initElasticSearchIndex.pyunverifiedcve_referencegithub.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C06_search_deleteElasticSearchByUids.pyunverifiedcve_referencegithub.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C11_search_addElasticSearchIndexByUid.pyunverifiedcve_referencegithub.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C07_search_deleteElasticSearchByUid.pyunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — moxi624 MoguBlog
In the same product, most dangerous first.
CVE-2026-89260HIGHMoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback EndpointEPSS 0.7%CVE-2026-89262HIGHMoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership CheckEPSS 0.5%CVE-2026-89263MEDIUMMoguBlog through 6.2 Missing Authentication on the Comment Email-Notification EndpointEPSS 0.5%CVE-2026-89265MEDIUMMoguBlog through 6.2 Missing Authorization on the Admin getPictureSortByUid EndpointEPSS 0.4%CVE-2026-89264MEDIUMMoguBlog through 6.2 Comment Author Spoofing via Request-Body IdentityEPSS 0.4%CVE-2026-109174HIGHMoguBlog through 6.2 Credential Disclosure via /oauth/getSystemConfigEPSS 0.2%
References
https://gitee.com/moxi159753/mogu_blog_v2/releaseshttps://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C05_search_initElasticSearchIndex.pyhttps://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C06_search_deleteElasticSearchByUids.pyhttps://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C07_search_deleteElasticSearchByUid.pyhttps://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C11_search_addElasticSearchIndexByUid.pyhttps://github.com/moxi624/mogu_blog_v2https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_search/src/main/java/com/moxi/mogublog/search/config/WebSecurityConfig.javahttps://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_search/src/main/java/com/moxi/mogublog/search/restapi/ElasticSearchRestApi.javahttps://www.vulncheck.com/advisories/mogublog-through-6.2-missing-authentication-for-elasticsearch-index-management-endpoints