Executive brief
Blog.Core is a framework used for building web applications and blog management systems. A security flaw in its user information interface allows unauthorized individuals to access sensitive administrator account details, including hashed passwords. An attacker could use this information to gain full control over the blog platform, potentially leading to data theft or unauthorized content modification.
Technical details
An improper access control vulnerability (CWE-284/CWE-863) exists in the 'getinfobytoken' API endpoint within the UserController of Blog.Core. The vulnerability allows a remote, unauthenticated attacker to retrieve sensitive user data, including the Super Administrator's hashed password, by providing a valid token as a URL parameter. While some metrics suggest low privileges are required, external analysis indicates that the lack of server-side validation on the token's relationship to the requested data allows for unauthorized information disclosure. This can lead to full administrative account takeover if the leaked password hashes are successfully cracked.
Affected products
- anjoy8 Blog.Core through bcb4d17
- anjoy8 Blog.Admin 8.0 and earlier
Timeline
- 2026-03-27: disclosed: Initial disclosure and CVE assignment
- 2026-03-27: advisory: NVD publication date