Executive brief
MoguBlog is a blogging platform that allows users to post articles and comments. This vulnerability enables attackers to delete any comment posted by any user, including entire comment threads, without needing special permissions. An attacker can obtain comment IDs from public listing pages and then delete them, disrupting user discussions and potentially silencing legitimate feedback.
Technical details
The comment deletion endpoint in MoguBlog's REST API performs authorization checks by comparing the request-body field commentVO.getUserUid() against stored ownership data, rather than validating the authenticated principal's identity. The /web/comment/delete endpoint is marked permitAll in WebSecurityConfig.java, meaning it accepts unauthenticated requests. Comment UIDs and author UIDs are publicly harvestable from the unauthenticated /web/comment/getList endpoint. An attacker can craft a DELETE request with arbitrary commentUid and userUid values to delete any comment and its child replies via soft-delete. No CVE patch status is documented in the advisory.
Affected products
- MoguBlog MoguBlog through 6.2
Timeline
- 2026-09-11: disclosed