Insecure Direct Object Reference in MoguBlog Product by Mogu
CVE-2026-109176

5.3MEDIUM

Key Information:

Vendor

Moxi624

Status
Mogublog
Vendor
CVE Published:
12 October 2026

Badges

👾 Exploit Exists

What is CVE-2026-109176?

The MoguBlog application, up to version 6.2, is susceptible to an insecure direct object reference vulnerability that affects file management. This issue allows authenticated administrators to inadvertently delete files belonging to other administrators through compromised API endpoints. Specifically, an attacker can manipulate the UID of another administrator's file or folder during the POST requests to /networkDisk/deleteFile and batchDeleteFile, resulting in the unauthorized removal of their storage objects without appropriate checks against the administrator's UID. This could lead to significant data loss and disruptions in administrative operations.

Affected Version(s)

MoguBlog 0 <= 6.2

References

https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1...
exploit
https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e...
technical-description
https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e...
technical-description

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yaqi Chao
.