CVE-2026-109176: MoguBlog Auth Bypass Vulnerability

CVE-2026-109176 Overview

CVE-2026-109176 is an Insecure Direct Object Reference (IDOR) vulnerability affecting MoguBlog through version 6.2. The flaw resides in the network disk file management endpoints, where authenticated administrators can delete files owned by other administrators. The vulnerable logic in NetworkDiskServiceImpl.deleteFile accepts a file or folder uid without validating that it belongs to the requesting administrator's admin_uid. Exploitation removes stored objects from the configured backend, including local storage, Qiniu, or MinIO. The weakness is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Any authenticated administrator can permanently delete files belonging to other administrators across local, Qiniu, and MinIO storage backends by supplying a target file or folder uid.

Affected Products

MoguBlog versions up to and including 6.2
MoguBlog mogu_picture module (NetworkDiskRestApi, NetworkDiskServiceImpl)
Deployments backed by local storage, Qiniu Cloud Storage, or MinIO

Discovery Timeline

2026-10-12 - CVE-2026-109176 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109176

Vulnerability Analysis

MoguBlog exposes a network disk feature that lets administrators upload, organize, and delete files through the mogu_picture service. Two endpoints, POST /networkDisk/deleteFile and POST /networkDisk/batchDeleteFile, invoke NetworkDiskServiceImpl.deleteFile to perform the deletion. The service resolves the target record by uid and proceeds to remove the backing object from the configured storage provider. No comparison is made between the record's owner field and the authenticated session's admin_uid. Any administrator can therefore target entries owned by peers and erase them from local disk, Qiniu, or MinIO buckets.

Root Cause

The root cause is missing object-level authorization in the deletion handler. The code path trusts the client-supplied identifier and treats administrator role membership as sufficient authorization. Because MoguBlog does not enforce per-record ownership checks, [CWE-639] applies: a user-controlled key maps directly to another principal's resource. The design assumes administrators form a trusted peer group, which breaks down in multi-tenant or role-separated deployments.

Attack Vector

An attacker needs a valid administrator session, which can be obtained through any provisioned admin account. The attacker enumerates or guesses file and folder uid values belonging to other administrators and submits them to /networkDisk/deleteFile or the batch variant. The server processes the request without ownership validation and removes the referenced objects from storage. The published proof-of-concept script demonstrates end-to-end exploitation against the API.

See the GitHub PoC Script and the vulnerable NetworkDiskServiceImpl source for technical details.

Detection Methods for CVE-2026-109176

Indicators of Compromise

Unexplained deletion events in local storage directories, Qiniu buckets, or MinIO buckets backing the MoguBlog mogu_picture service.
Application logs showing POST /networkDisk/deleteFile or POST /networkDisk/batchDeleteFile requests where the authenticated admin_uid differs from the owning admin_uid of the referenced record.
Database rows removed from the network disk table shortly after an administrator login from an unusual IP address or user-agent.

Detection Strategies

Instrument NetworkDiskServiceImpl.deleteFile to log the requesting admin_uid, the target record's owner, and the resolved storage path for each invocation.
Correlate administrator session identifiers against deletion volume to detect bulk or scripted use of the batch delete endpoint.
Alert on object-storage API calls (Qiniu, MinIO) that originate from the MoguBlog service outside of normal administrator working hours.

Monitoring Recommendations

Enable S3-compatible access logging on MinIO and audit logging on Qiniu to retain deletion events for forensic review.
Monitor web server access logs for repeated POST requests to /networkDisk/deleteFile and /networkDisk/batchDeleteFile with varying uid parameters.
Review administrator account inventories and remove unused or shared accounts that could be abused to trigger this IDOR.

How to Mitigate CVE-2026-109176

Immediate Actions Required

Restrict administrative access to the MoguBlog backend to trusted operators only and rotate credentials for any shared or dormant admin accounts.
Place the mogu_picture service behind a reverse proxy that denies direct public access to /networkDisk/deleteFile and /networkDisk/batchDeleteFile.
Enable storage versioning or soft-delete on MinIO and Qiniu buckets so that unauthorized deletions can be recovered.
Review the VulnCheck Security Advisory for current remediation guidance.

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry for MoguBlog through 6.2. Operators should track the upstream MoguBlog repository for updates to NetworkDiskServiceImpl that introduce ownership validation against admin_uid before deletion.

Workarounds

Apply a local source patch to NetworkDiskServiceImpl.deleteFile that compares the authenticated administrator's admin_uid with the target record's owner and rejects mismatches.
Enforce bucket-level IAM policies on MinIO and Qiniu that scope deletions to directories owned by the issuing administrator.
Enable soft-delete, object versioning, and off-platform backups for all storage backends so that erroneous deletions can be reverted.

bash

# Configuration example: enable MinIO bucket versioning and lifecycle protection
mc alias set mogu https://minio.example.local ACCESS_KEY SECRET_KEY
mc version enable mogu/mogublog-networkdisk
mc ilm add --expiry-days 30 --noncurrentversion-expiry-days 90 mogu/mogublog-networkdisk