CVE-2026-89265: MoguBlog Authorization Bypass Vulnerability

CVE-2026-89265 Overview

CVE-2026-89265 is a missing authorization vulnerability in MoguBlog versions through 6.2. The flaw resides in the POST /pictureSort/getPictureSortByUid endpoint of the administrative back-office, which omits the @AuthorityVerify annotation used to enforce role-based permissions. Authenticated back-office users lacking image-category permissions can supply a category uid and retrieve restricted image-category records. Exposed fields include category name, cover file uid, sort order, and timestamps. The weakness is classified as [CWE-862] Missing Authorization and requires low-privileged network access.

Critical Impact

Any authenticated back-office user can enumerate and read image-category metadata regardless of assigned role, breaking the application's role-based access control model.

Affected Products

• MoguBlog (mogu_blog_v2) versions up to and including 6.2
• Component: mogu_admin module, PictureSortRestApi controller
• Endpoint: POST /pictureSort/getPictureSortByUid

Discovery Timeline

• 2026-09-11 - CVE-2026-89265 published to the National Vulnerability Database (NVD)
• 2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89265

Vulnerability Analysis

MoguBlog relies on a custom @AuthorityVerify annotation applied to REST controller methods in the mogu_admin module. The annotation triggers a role and permission check before the handler executes. In PictureSortRestApi.java, the getPictureSortByUid handler was defined without this annotation. As a result, the application authenticates the caller's session but skips the authorization decision entirely.

An authenticated user with any back-office account, including low-privileged roles, can invoke the endpoint and receive image-category records belonging to restricted areas. The response includes the category name, cover file uid, sort order, and creation and update timestamps. This breaks tenant and role isolation on image-category data and enables enumeration of internal content structure.

Root Cause

The root cause is a missing authorization check on a single controller method. Access control in MoguBlog is enforced declaratively through the @AuthorityVerify annotation rather than by a centralized filter. When a developer omits the annotation, the framework grants access to every authenticated user by default. This fail-open design pattern is characteristic of [CWE-862] Missing Authorization and produces silent gaps that do not surface during authentication testing.

Attack Vector

Exploitation requires a valid back-office session cookie or token and network reachability to the admin API. The attacker sends a POST request to /pictureSort/getPictureSortByUid with a target category uid in the request body. The server returns the full record even when the caller's role has no image-category permission. A public proof-of-concept script demonstrating the request flow is available on GitHub. See the GitHub PoC Script for Mogu Blog and the vulnerable PictureSortRestApi source for reference.

Detection Methods for CVE-2026-89265

Indicators of Compromise

• POST requests to /pictureSort/getPictureSortByUid originating from accounts that lack the image-category role
• Unusual volume of getPictureSortByUid requests iterating through sequential or brute-forced uid values
• Back-office session IDs accessing image-category endpoints outside of documented workflows

Detection Strategies

• Correlate authenticated user role assignments with accessed admin endpoints in web-server access logs
• Alert on responses to /pictureSort/getPictureSortByUid that return HTTP 200 with populated data fields for non-privileged accounts
• Deploy an authorization decision log at the application layer and flag any handler that returns success without invoking @AuthorityVerify

Monitoring Recommendations

• Ingest MoguBlog admin API logs into a centralized SIEM and normalize user, role, endpoint, and status fields
• Track per-user request rates to /pictureSort/* endpoints and alert on deviations from baseline
• Review audit trails after upgrades to confirm authorization annotations remain in place

How to Mitigate CVE-2026-89265

Immediate Actions Required

• Restrict access to the MoguBlog admin interface to trusted networks or VPN users until a patched release is deployed
• Review all back-office accounts, disable unused users, and enforce least-privilege role assignments
• Rotate credentials for any low-privileged accounts that may have been used to enumerate restricted categories

Patch Information

Monitor the Gitee Mogu Blog Releases page and the GitHub Mogu Blog Repository for a fixed release beyond version 6.2. Refer to the VulnCheck Advisory on Mogu Blog for advisory updates.

Workarounds

• Add the @AuthorityVerify annotation to the getPictureSortByUid handler in PictureSortRestApi.java and rebuild the mogu_admin module
• Block the /pictureSort/getPictureSortByUid route at a reverse proxy for user groups without image-category permissions
• Audit every controller in mogu_admin for missing @AuthorityVerify annotations and apply the same fix pattern

# Example nginx rule to restrict the vulnerable endpoint by source network
location = /pictureSort/getPictureSortByUid {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://mogu_admin_backend;
}