Executive brief
Magefan Blog GraphQL is a Magento 2 extension that allows blog management and commenting. An unauthenticated attacker can query the blogComments GraphQL endpoint to retrieve sensitive commenter information including email addresses and internal customer/admin identifiers. This data is not displayed on public blog pages and is considered personal information under GDPR, exposing the site operator to privacy violations and potential regulatory fines.
Technical details
The vulnerability is a missing authorization/field-level access control flaw in the blogComments GraphQL query resolver. The blogComments query is exposed as a top-level Query field without an access directive, and the resolver in Model/Resolver/Comments.php builds search criteria from only status and caller-supplied post_id with no per-user scoping or field allowlist. An unauthenticated attacker can issue a POST request to /graphql with a blogComments query requesting author_email, customer_id, or admin_id fields and retrieve sensitive data for all approved comments. By iterating post_id values, an attacker can harvest email addresses of all commenters on the site. No authentication, cookies, or user interaction is required.
Affected products
- Magefan Blog GraphQL for Magento 2 through 2.2.1
Timeline
- 2026-09-09: disclosed
- 2026-06-24: other: Latest release (2.2.1) published with vulnerability still present