CVE-2026-109174 Overview
CVE-2026-109174 is an information disclosure vulnerability in MoguBlog through version 6.2. The flaw resides in the getSystemConfig endpoint of the OAuth-facing AuthRestApi controller. Low-privileged front-end users can supply an ordinary reader session token and retrieve the complete, unfiltered SystemConfig object. The response exposes Qiniu object storage secret keys, MinIO secret keys, and Simple Mail Transfer Protocol (SMTP) mailbox passwords. This weakness is classified as improper authorization [CWE-863].
Critical Impact
Any authenticated reader can harvest cloud storage credentials and SMTP passwords, enabling takeover of connected Qiniu and MinIO buckets and abuse of outbound mail infrastructure.
Affected Products
- MoguBlog versions up to and including 6.2
- Deployments exposing the mogu_web module AuthRestApi endpoint
- Installations integrated with Qiniu, MinIO, or SMTP credentials in SystemConfig
Discovery Timeline
- 2026-10-12 - CVE-2026-109174 published to the National Vulnerability Database (NVD)
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-109174
Vulnerability Analysis
MoguBlog exposes a REST endpoint at /oauth/getSystemConfig through the front-end AuthRestApi controller. The handler returns the full SystemConfig entity serialized as JSON. The server performs authentication, verifying that the caller presents a valid session token, but it does not enforce an authorization check restricting access to administrators. As a result, any user with a standard reader account can request configuration data intended for privileged roles.
The returned object includes integration secrets stored in plaintext within the application database. These secrets are used by MoguBlog to upload media to Qiniu or MinIO buckets and to send transactional email through SMTP. Disclosure of these values grants attackers the same level of access to those external services that the blog itself holds.
Root Cause
The root cause is a missing authorization control at the controller layer. The getSystemConfig method relies solely on authentication rather than role-based access control. Sensitive fields such as qiniuSecretKey, minioSecretKey, and mailboxPassword are serialized directly from the entity without a response filter or data transfer object (DTO) to strip privileged values before delivery to the client.
Attack Vector
Exploitation requires only network access to the MoguBlog instance and valid credentials for any front-end account. An attacker registers or compromises a reader-tier user, obtains an OAuth session token, and issues an HTTP GET request to the getSystemConfig endpoint. The server responds with the full configuration payload containing the plaintext secrets. A published proof-of-concept is available in the GitHub PoC Repository, and the vulnerable handler is documented in the GitHub Auth API Source Code.
Detection Methods for CVE-2026-109174
Indicators of Compromise
- HTTP GET requests to /oauth/getSystemConfig originating from non-administrative session tokens
- Outbound traffic from attacker infrastructure to Qiniu or MinIO endpoints using credentials associated with the blog service account
- Unexpected SMTP authentication events from external IPs using the mailbox account configured in SystemConfig
Detection Strategies
- Review web server and application access logs for calls to getSystemConfig and correlate the requesting user ID against the administrator role list.
- Inspect object storage audit logs for new AccessKey usage from unfamiliar source IPs after the exposure window.
- Alert on SMTP relay activity that deviates from the application's historical sending patterns or geolocation.
Monitoring Recommendations
- Enable request-level logging in the mogu_web module and forward logs to a centralized Security Information and Event Management (SIEM) platform.
- Monitor Qiniu and MinIO IAM dashboards for key usage anomalies and rotate credentials if abnormal access is observed.
- Track outbound SMTP volume for the configured mailbox account and alert on sudden spikes.
How to Mitigate CVE-2026-109174
Immediate Actions Required
- Restrict network access to the MoguBlog administrative and OAuth endpoints to trusted IP ranges until a fix is deployed.
- Rotate all Qiniu, MinIO, and SMTP credentials stored in the SystemConfig table.
- Review Qiniu and MinIO bucket contents and SMTP outbound logs for signs of unauthorized use.
Patch Information
No vendor patch is referenced in the NVD entry at the time of publication. Operators should monitor the VulnCheck Advisory on Mogublog and the upstream MoguBlog repository for an authorized release.
Workarounds
- Add a role check to the getSystemConfig handler so that only administrator tokens receive the configuration payload.
- Introduce a DTO that returns only non-sensitive display fields and omits qiniuSecretKey, minioSecretKey, and mailboxPassword.
- Block or require authentication at a reverse proxy for the /oauth/getSystemConfig path pending a code-level fix.
- Disable or deregister unused reader accounts to reduce the pool of tokens that can reach the endpoint.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
