---
id: CVE-2026-109174
title: >-
  MoguBlog through 6.2 contains an information disclosure vulnerability that
  allows low-privileged front-end users to read system credentials via the
  getSystemConfig endpoint
summary: >-
  MoguBlog through 6.2 contains an information disclosure vulnerability that
  allows low-privileged front-end users to read system credentials via the
  getSystemConfig endpoint. Attackers can supply an ordinary reader session
  token to retrie…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-863
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T13:17:30.040'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109174'
references:
  - url: >-
      https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/mogu_blog_v2/poc_oauth_getSystemConfig.py
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_web/src/main/java/com/moxi/mogublog/web/restapi/AuthRestApi.java#L490-L502
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/mogublog-through-6.2-credential-disclosure-via-oauth-getsystemconfig
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-12T14:50:34.112Z'
---

## Overview

MoguBlog through 6.2 contains an information disclosure vulnerability that allows low-privileged front-end users to read system credentials via the getSystemConfig endpoint. Attackers can supply an ordinary reader session token to retrieve unfiltered SystemConfig data, exposing Qiniu and MinIO secret keys and SMTP mailbox passwords.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.