CVE-2026-109175: MoguBlog Information Disclosure Flaw

CVE-2026-109175 Overview

CVE-2026-109175 is an insecure direct object reference (IDOR) vulnerability in MoguBlog through version 6.2. The flaw resides in the POST /networkDisk/getFileList endpoint, which fails to scope queries by the requesting administrator's identifier (admin_uid). Authenticated administrators can enumerate network-disk files belonging to other administrators, retrieving file names and download URLs. The weakness is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Any authenticated administrator can list and download files uploaded by any other administrator, exposing potentially sensitive content stored in the network-disk feature.

Affected Products

MoguBlog (mogu_blog_v2) versions through 6.2
mogu_picture service component (NetworkDiskRestApi)
Deployments exposing the /networkDisk/getFileList endpoint

Discovery Timeline

2026-10-12 - CVE-2026-109175 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109175

Vulnerability Analysis

MoguBlog ships a network-disk feature that lets administrators upload and manage files. The listing endpoint accepts filter parameters including status, fileType, and filePath, then returns matching records from the shared data store. The server-side query never constrains results to the authenticated caller's admin_uid. As a result, any valid administrator session can enumerate every administrator's files across the deployment.

The exposed data includes file names and direct download URLs. Because download URLs are often served without additional ownership checks, the IDOR escalates from read enumeration to full file retrieval. Confidentiality of files intended to be private to each administrator is lost.

Root Cause

The root cause is missing object-level authorization in the service layer that backs NetworkDiskRestApi. The implementation at NetworkDiskServiceImpl constructs its query predicate from client-supplied filters only. There is no server-enforced tenant key tying returned rows to the caller. See the vulnerable listing method in the Network Disk service source and the exposing controller in NetworkDiskRestApi.

Attack Vector

Exploitation requires network access to the admin API and a valid administrator token. The attacker issues a POST request to /networkDisk/getFileList with benign filter values such as a wildcard filePath or an unrestricted status. The server returns records belonging to other administrators. The attacker then issues standard HTTP GET requests to each returned download URL to retrieve file contents. A public proof-of-concept is available at the GitHub PoC script.

// No synthetic code shown — see the referenced PoC and source links for
// the exact request shape and vulnerable query construction.

Detection Methods for CVE-2026-109175

Indicators of Compromise

Requests to POST /networkDisk/getFileList originating from one administrator account but returning large result sets spanning multiple admin_uid values.
Sequential or bulk GETs to network-disk download URLs that do not correspond to files uploaded by the requesting session.
Unusual outbound transfer volume from the mogu_picture service shortly after a getFileList call.

Detection Strategies

Instrument the NetworkDiskServiceImpl.getFileList call path to log the authenticated admin_uid alongside the admin_uid of each returned record and alert on mismatches.
Create web application firewall rules that correlate getFileList responses with the number of distinct owners represented in the result payload.
Review access logs for administrator accounts that query the endpoint more frequently than their normal workflow baseline.

Monitoring Recommendations

Forward MoguBlog application logs and reverse-proxy access logs to a centralized analytics platform for retrospective hunting.
Track per-account download URL retrieval patterns and alert on access to files not previously uploaded by that account.
Monitor administrator account creation and privilege changes, since the vulnerability is reachable only after authentication.

How to Mitigate CVE-2026-109175

Immediate Actions Required

Restrict network reachability of the /networkDisk/* endpoints to trusted administrator networks or VPN clients.
Audit the administrator account inventory and remove accounts that are inactive or unnecessary.
Review historical application logs for prior enumeration of getFileList responses that returned files owned by other administrators.

Patch Information

No vendor-fixed version is listed in the NVD entry at the time of publication. Monitor the VulnCheck advisory and the upstream mogu_blog_v2 repository for an official patch. Until a fix ships, apply the code-level change described below: add an admin_uid predicate in NetworkDiskServiceImpl.getFileList so the query returns only records owned by the authenticated caller.

Workarounds

Deploy a reverse-proxy or API-gateway rule that rejects POST /networkDisk/getFileList requests from accounts other than a short allowlist until a patched build is available.
Add a server-side filter in NetworkDiskServiceImpl that injects the session admin_uid into every query, overriding any client-supplied value.
Rotate credentials and signed download URLs for files that may have been exposed through enumeration.

bash

# Example NGINX rule restricting the vulnerable endpoint to a trusted CIDR
location = /networkDisk/getFileList {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://mogublog_backend;
}