{"id":"CVE-2026-89265","title":"MoguBlog through 6.2 Missing Authorization on the Admin getPictureSortByUid Endpoint","summary":"MoguBlog through 6.2 contains an authorization bypass vulnerability in the POST /pictureSort/getPictureSortByUid endpoint, which omits the @AuthorityVerify annotation required to enforce role-based permissions. Authenticated back-office …","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-862"],"vendor":"moxi624","product":"MoguBlog","affected":["MoguBlog <= 6.2"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-11T16:56:37.767218Z"},"exploitAvailable":true,"published":"2026-09-11","updated":"2026-09-11","sourceUpdated":"2026-09-11T20:29:28.878Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89265","references":[{"url":"https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C13_pictureSort_getByUid_bfla.py","label":"C13 - POST /pictureSort/getPictureSortByUid proof of concept"},{"url":"https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_admin/src/main/java/com/moxi/mogublog/admin/restapi/PictureSortRestApi.java","label":"PictureSortRestApi.getPictureSortByUid is the only method in the controller without @AuthorityVerify"},{"url":"https://gitee.com/moxi159753/mogu_blog_v2/releases","label":"MoguBlog releases"},{"url":"https://github.com/moxi624/mogu_blog_v2","label":"Product"},{"url":"https://www.vulncheck.com/advisories/mogublog-through-6.2-missing-authorization-on-the-admin-getpicturesortbyuid-endpoint","label":"VulnCheck Advisory: MoguBlog through 6.2 Missing Authorization on the Admin getPictureSortByUid Endpoint"}],"tags":["cve.org","exploit-available"],"epss":0.00214,"epssPercentile":0.12028,"ingestedAt":"2026-09-14T11:11:19.882Z","slug":"CVE-2026-89265","body":"## Overview\n\nMoguBlog through 6.2 contains an authorization bypass vulnerability in the POST /pictureSort/getPictureSortByUid endpoint, which omits the @AuthorityVerify annotation required to enforce role-based permissions. Authenticated back-office users without image-category permissions can supply a category uid to retrieve restricted image-category records including metadata such as name, cover file uid, sort order and timestamps.\n\n## Affected\n\n- `MoguBlog <= 6.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":36,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}