CVE-2026-79323: Magefan Blog GraphQL Information Disclosure

CVE-2026-79323 Overview

CVE-2026-79323 is an information disclosure vulnerability in the blogComments GraphQL query exposed by the Magefan Blog GraphQL module for Magento 2 (magefan/module-blog-graph-ql) through version 2.2.1. Remote unauthenticated attackers can issue a POST request to /graphql and retrieve blog commenter email addresses along with internal customer and admin identifiers. The flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Because the query returns data that should be restricted to privileged contexts, attackers can enumerate personally identifiable information (PII) and internal account IDs at scale.

Critical Impact
Unauthenticated remote attackers can harvest blog commenter emails plus internal customer and admin identifiers from any affected Magento 2 storefront by sending a single GraphQL query.

Affected Products

Magefan Blog GraphQL for Magento 2 (magefan/module-blog-graph-ql) versions up to and including 2.2.1
Magento 2 storefronts with the Magefan Blog GraphQL module installed
Any deployment exposing the /graphql endpoint publicly

Discovery Timeline

2026-09-09 - CVE-2026-79323 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-79323

Vulnerability Analysis

The blogComments GraphQL resolver in the Magefan Blog GraphQL module returns comment records without filtering sensitive fields based on the caller's authentication context. When a client issues a POST request to /graphql containing a blogComments query, the resolver serializes fields that include commenter email addresses along with internal identifiers referencing customer and admin accounts.

GraphQL endpoints in Magento 2 are typically exposed to unauthenticated clients so that storefronts and headless frontends can operate. The module does not distinguish between fields that are safe for public consumption (such as approved comment text) and fields that reference PII or internal account state. As a result, any attacker who can reach /graphql can enumerate comment records and correlate them with customer or admin IDs.

The disclosed data supports downstream attacks. Email addresses enable targeted phishing against known customers and store administrators. Internal customer and admin identifiers can be used as inputs to other Magento GraphQL or REST queries, expanding the attack surface for account enumeration and credential stuffing.

Root Cause

The root cause is missing authorization and field-level filtering in the blogComments GraphQL resolver. The resolver returns the full comment entity — including fields intended for administrative views — instead of a public projection that omits email addresses and account foreign keys. This aligns with [CWE-200] where sensitive information is exposed to an actor without the required authorization.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted GraphQL POST request to the public /graphql endpoint of a vulnerable Magento 2 store. The request specifies the blogComments query and selects fields that include commenter email addresses and customer or admin identifiers. The server returns the sensitive data in the standard GraphQL JSON response.

No exploitation code is required beyond a standard HTTP client capable of sending GraphQL queries. Refer to the public GitHub Gist and the Magefan Blog Extension overview for additional context on the affected component.

Detection Methods for CVE-2026-79323

Indicators of Compromise

POST requests to /graphql containing the string blogComments in the request body, especially from unauthenticated sessions or unknown IP ranges.
GraphQL queries selecting fields such as email, customer_id, or admin identifier fields under the blogComments type.
High-volume or paginated GraphQL requests iterating through comment records from a single client.

Detection Strategies

Inspect web server and application logs for POST requests to /graphql and parse the request body for blogComments operations.
Deploy a web application firewall (WAF) rule that flags GraphQL queries requesting sensitive comment fields from unauthenticated clients.
Correlate GraphQL access logs with rate-based anomaly detection to identify enumeration behavior against the comments dataset.

Monitoring Recommendations

Enable verbose logging on the Magento 2 GraphQL endpoint and forward logs to a centralized SIEM for retention and query.
Alert on unauthenticated GraphQL requests that reference blog-related types outside of expected storefront traffic patterns.
Track outbound data volumes from the /graphql endpoint to identify bulk extraction of comment records.

How to Mitigate CVE-2026-79323

Immediate Actions Required

Inventory all Magento 2 deployments and confirm whether magefan/module-blog-graph-ql is installed and at which version.
Restrict public access to the /graphql endpoint where feasible, or place a WAF rule in front of it to block blogComments queries from unauthenticated clients.
Notify affected users if evidence of enumeration exists, per applicable data breach notification requirements.

Patch Information

No fixed version is listed in the NVD entry at the time of publication. Versions of magefan/module-blog-graph-ql through 2.2.1 are affected. Monitor the Magefan Blog Extension page and the module's release notes for a patched release, and upgrade as soon as a fixed version is available.

Workarounds

Disable the Magefan Blog GraphQL module in Magento configuration if blog comments are not exposed via the storefront GraphQL API.
Add a reverse proxy or WAF rule that blocks GraphQL POST requests containing the blogComments operation until a patched version is deployed.
Remove or restrict the email, customer_id, and admin identifier fields from the GraphQL schema by overriding the resolver in a custom module.

bash

# Example nginx rule to block blogComments GraphQL queries at the edge
location = /graphql {
    if ($request_method = POST) {
        access_by_lua_block {
            ngx.req.read_body()
            local body = ngx.req.get_body_data() or ""
            if string.find(body, "blogComments") then
                ngx.exit(403)
            end
        }
    }
    proxy_pass http://magento_backend;
}