CVE-2026-109177: MoguBlog Auth Bypass Vulnerability

CVE-2026-109177 Overview

CVE-2026-109177 is a broken access control vulnerability affecting MoguBlog through version 6.2. The flaw resides in the network-disk file management endpoints, which fail to verify ownership of target files before performing move, batch move, or rename operations. Authenticated administrators can supply arbitrary file paths belonging to other administrators and manipulate those files without authorization. The vulnerability is categorized as an Insecure Direct Object Reference issue, tracked under [CWE-639]. Exploitation requires only a low-privileged authenticated administrator account and network access to the application.

Critical Impact

Authenticated administrators can relocate or rename other administrators' network-disk files and folders by sending crafted requests to the vulnerable /networkDisk/moveFile, batchMoveFile, or edit endpoints.

Affected Products

• MoguBlog versions through 6.2
• mogu_picture service NetworkDiskRestApi component
• NetworkDiskServiceImpl service implementation

Discovery Timeline

• 2026-10-12 - CVE-2026-109177 published to NVD
• 2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-109177

Vulnerability Analysis

MoguBlog implements a network-disk feature allowing administrators to manage personal file hierarchies within the mogu_picture microservice. The NetworkDiskRestApi class exposes endpoints for moving, batch-moving, and editing file entries. These endpoints accept client-supplied identifiers that reference file records in the backing database.

The service layer in NetworkDiskServiceImpl executes update operations against the matched rows without comparing the record's admin_uid field to the authenticated session's administrator identifier. Any administrator session can therefore operate on records owned by other administrators by providing their file paths or identifiers.

Root Cause

The root cause is a missing ownership check in the server-side authorization logic. The affected handlers trust client-supplied object references and perform SQL updates based solely on the record identifier. There is no filter clause binding the update to the current session's admin_uid, nor any pre-update query to validate ownership. This matches the pattern described by CWE-639: Authorization Bypass Through User-Controlled Key.

Attack Vector

An attacker with any administrator-level account issues an HTTP POST request to /networkDisk/moveFile, /networkDisk/batchMoveFile, or /networkDisk/edit, supplying file paths or identifiers owned by a victim administrator. The server processes the request and updates the targeted records, moving them to a path controlled by the attacker or renaming them. The attack vector is network-reachable and requires low privileges with no user interaction. A public proof of concept is available in the GitHub PoC Repository.

No verified code snippet is included here. Review the vulnerable handler in the GitHub API Implementation and the backing GitHub Service Implementation for the complete call chain.

Detection Methods for CVE-2026-109177

Indicators of Compromise

• POST requests to /networkDisk/moveFile, /networkDisk/batchMoveFile, or /networkDisk/edit where the targeted file identifier does not belong to the authenticated administrator.
• Database rows in the network-disk table showing admin_uid mismatches between the record owner and the session that last modified the row.
• Unexpected changes in file paths, parent folder identifiers, or filenames in the network-disk inventory without a corresponding user action from the owning administrator.

Detection Strategies

• Enable verbose request logging on the mogu_picture service and correlate the authenticated administrator session with the admin_uid of each file identifier referenced in move or edit requests.
• Deploy application-layer rules that flag any network-disk mutation where the target record's owner differs from the acting administrator.
• Baseline normal file-management activity per administrator and alert on cross-user path references in request bodies.

Monitoring Recommendations

• Monitor administrator audit logs for unusual bursts of moveFile, batchMoveFile, or edit operations originating from a single session.
• Track database writes to the network-disk table where the admin_uid column of the updated row does not match the actor identifier.
• Alert on administrator accounts that reference file paths or folder identifiers outside their own directory tree.

How to Mitigate CVE-2026-109177

Immediate Actions Required

• Restrict administrator account provisioning and audit all existing administrator sessions on MoguBlog deployments through 6.2.
• Apply upstream patches as soon as they become available; monitor the VulnCheck Security Advisory for fix status.
• Add server-side ownership validation to moveFile, batchMoveFile, and edit handlers so every operation enforces an admin_uid match against the session.
• Review network-disk tables for unauthorized modifications by comparing current record ownership against historical backups.

Patch Information

No vendor patch has been published in the enriched NVD record at the time of writing. The upstream project is moxi624/mogu_blog_v2. Track the project's commit history and the referenced advisory for a fixed release.

Workarounds

• Limit administrator account creation to trusted personnel until a patched version is deployed.
• Place the mogu_picture service behind a reverse proxy that enforces per-user path scoping, rejecting requests where the referenced file identifier belongs to a different administrator.
• Introduce a database trigger or application middleware that aborts updates to the network-disk table when the admin_uid of the affected row does not match the acting session.

# Example reverse-proxy rule concept (nginx) - block cross-admin references
# Enforce that requests to /networkDisk/* carry a signed admin context header
# and reject any mutating request lacking it.
location /networkDisk/ {
    if ($request_method ~* "(POST|PUT|DELETE)") {
        if ($http_x_admin_context = "") { return 403; }
    }
    proxy_pass http://mogu_picture_upstream;
}