---
id: CVE-2026-89262
title: >-
  MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership
  Check
summary: >-
  MoguBlog through 6.2 contains an authorization bypass vulnerability in the
  comment deletion endpoint that performs ownership checks against request-body
  fields instead of the authenticated principal. Attackers can delete arbitrary
  commen…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: moxi624
product: MoguBlog
affected:
  - MoguBlog <= 6.2
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-11T18:17:11.892135Z'
exploitAvailable: true
published: '2026-09-11'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T18:17:21.130Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89262'
references:
  - url: >-
      https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C04_comment_delete_idor.py
    label: C04 - POST /web/comment/delete proof of concept
  - url: >-
      https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_web/src/main/java/com/moxi/mogublog/web/restapi/CommentRestApi.java
    label: >-
      CommentRestApi.deleteBatch compares the stored author uid against a
      request-body field
  - url: >-
      https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_web/src/main/java/com/moxi/mogublog/web/config/WebSecurityConfig.java
    label: mogu_web WebSecurityConfig permits /web/comment/** for all callers
  - url: 'https://gitee.com/moxi159753/mogu_blog_v2/releases'
    label: MoguBlog releases
  - url: 'https://github.com/moxi624/mogu_blog_v2'
    label: Product
  - url: >-
      https://www.vulncheck.com/advisories/mogublog-through-6.2-arbitrary-comment-deletion-via-request-body-ownership-check
    label: >-
      VulnCheck Advisory: MoguBlog through 6.2 Arbitrary Comment Deletion via
      Request-Body Ownership Check
tags:
  - cve.org
  - exploit-available
epss: 0.00309
epssPercentile: 0.23956
ingestedAt: '2026-09-14T00:35:28.535Z'
---

## Overview

MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by supplying comment UIDs and author UIDs obtained from unauthenticated listing endpoints.

## Affected

- `MoguBlog <= 6.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.