CVE-2026-89264: MOXI624 Mogublog

Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days.

MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attributed to any other user. Attackers can supply arbitrary userUid values in the request body to impersonate other accounts including administrators.

Affected products

• MOXI624 Mogublog: up to and including 6.2

Published 2026-09-11. Last modified 2026-09-11.