CVE-2026-89261: falha de média gravidade em moxi624 MoguBlog
MoguBlog through 6.2 Missing Authentication for Elasticsearch Index Management Endpoints
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
33Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 6.9epss 0.8%
MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogu_search service without authentication, allowing remote attackers to delete, recreate, or alter the blog search index. Attackers can invoke POST endpoints to wipe the entire search index, delete specific documents, or inject malicious index entries, causing search functionality to return incorrect or no results.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Produtos afetados
moxi624 · MoguBlogPoCs públicas encontradas — 4
cve_referencegithub.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C05_search_initElasticSearchIndex.pynão verificadocve_referencegithub.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C06_search_deleteElasticSearchByUids.pynão verificadocve_referencegithub.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C11_search_addElasticSearchIndexByUid.pynão verificadocve_referencegithub.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C07_search_deleteElasticSearchByUid.pynão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — moxi624 MoguBlog
No mesmo produto, das mais perigosas para as menos.
CVE-2026-89260HIGHMoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback EndpointEPSS 0.7%CVE-2026-89262HIGHMoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership CheckEPSS 0.5%CVE-2026-89263MEDIUMMoguBlog through 6.2 Missing Authentication on the Comment Email-Notification EndpointEPSS 0.5%CVE-2026-89265MEDIUMMoguBlog through 6.2 Missing Authorization on the Admin getPictureSortByUid EndpointEPSS 0.4%CVE-2026-89264MEDIUMMoguBlog through 6.2 Comment Author Spoofing via Request-Body IdentityEPSS 0.4%CVE-2026-109174HIGHMoguBlog through 6.2 Credential Disclosure via /oauth/getSystemConfigEPSS 0.2%
Referências
https://gitee.com/moxi159753/mogu_blog_v2/releaseshttps://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C05_search_initElasticSearchIndex.pyhttps://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C06_search_deleteElasticSearchByUids.pyhttps://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C07_search_deleteElasticSearchByUid.pyhttps://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C11_search_addElasticSearchIndexByUid.pyhttps://github.com/moxi624/mogu_blog_v2https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_search/src/main/java/com/moxi/mogublog/search/config/WebSecurityConfig.javahttps://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_search/src/main/java/com/moxi/mogublog/search/restapi/ElasticSearchRestApi.javahttps://www.vulncheck.com/advisories/mogublog-through-6.2-missing-authentication-for-elasticsearch-index-management-endpoints