---
id: CVE-2026-89263
title: >-
  MoguBlog through 6.2 fails to authenticate requests to the
  /web/comment/closeEmailNotification endpoint, allowing unauthenticated
  attackers to disable email notifications for arbitrary users
summary: >-
  MoguBlog through 6.2 fails to authenticate requests to the
  /web/comment/closeEmailNotification endpoint, allowing unauthenticated
  attackers to disable email notifications for arbitrary users. Remote callers
  can modify the startEmailNotif…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-306
vendor: moxi624
product: MoguBlog
affected:
  - MoguBlog <= 6.2
published: '2026-09-11'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T17:17:36.273'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89263'
references:
  - url: 'https://gitee.com/moxi159753/mogu_blog_v2/releases'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C08_comment_closeEmailNotification.py
    label: disclosure@vulncheck.com
  - url: 'https://github.com/moxi624/mogu_blog_v2'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_web/src/main/java/com/moxi/mogublog/web/config/WebSecurityConfig.java
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_web/src/main/java/com/moxi/mogublog/web/restapi/CommentRestApi.java
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/mogublog-through-6.2-missing-authentication-on-the-comment-email-notification-endpoint
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-15T16:21:07.875781Z'
epss: 0.0026
epssPercentile: 0.18079
ingestedAt: '2026-09-11T16:45:47.862Z'
---

## Overview

MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. Remote callers can modify the startEmailNotification flag in Redis cache for any user identifier to suppress reply notifications without authorization.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.