CVE-2026-89261mediumCWE-306

CVE-2026-89261: fallo de gravedad media en moxi624 MoguBlog

MoguBlog through 6.2 Missing Authentication for Elasticsearch Index Management Endpoints

Publicada el 11 sep 2026 · Actualizada el 24 sep 2026

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

33Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 6.9epss 0.8%

MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogu_search service without authentication, allowing remote attackers to delete, recreate, or alter the blog search index. Attackers can invoke POST endpoints to wipe the entire search index, delete specific documents, or inject malicious index entries, causing search functionality to return incorrect or no results.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Productos afectados

moxi624 · MoguBlog

PoCs públicas encontradas — 4

cve_referencegithub.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C05_search_initElasticSearchIndex.pyno verificado cve_referencegithub.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C06_search_deleteElasticSearchByUids.pyno verificado cve_referencegithub.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C11_search_addElasticSearchIndexByUid.pyno verificado cve_referencegithub.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C07_search_deleteElasticSearchByUid.pyno verificado

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

CVEs relacionadas — moxi624 MoguBlog

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-89260HIGHMoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback EndpointEPSS 0.7%CVE-2026-89262HIGHMoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership CheckEPSS 0.5%CVE-2026-89263MEDIUMMoguBlog through 6.2 Missing Authentication on the Comment Email-Notification EndpointEPSS 0.5%CVE-2026-89265MEDIUMMoguBlog through 6.2 Missing Authorization on the Admin getPictureSortByUid EndpointEPSS 0.4%CVE-2026-89264MEDIUMMoguBlog through 6.2 Comment Author Spoofing via Request-Body IdentityEPSS 0.4%CVE-2026-109174HIGHMoguBlog through 6.2 Credential Disclosure via /oauth/getSystemConfigEPSS 0.2%

Referencias

https://gitee.com/moxi159753/mogu_blog_v2/releases https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C05_search_initElasticSearchIndex.py https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C06_search_deleteElasticSearchByUids.py https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C07_search_deleteElasticSearchByUid.py https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C11_search_addElasticSearchIndexByUid.py https://github.com/moxi624/mogu_blog_v2 https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_search/src/main/java/com/moxi/mogublog/search/config/WebSecurityConfig.java https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_search/src/main/java/com/moxi/mogublog/search/restapi/ElasticSearchRestApi.java https://www.vulncheck.com/advisories/mogublog-through-6.2-missing-authentication-for-elasticsearch-index-management-endpoints