# CVE-2026-89262: MoguBlog comment deletion authorization bypass

Source: https://junglewise.ai/threats/cve-2026-89262-mogublog-comment-deletion-authorization-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-11. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-89262 · Severity: high · CVSS 7.5 · Published 2026-09-11

MoguBlog is a blogging platform that allows users to post articles and comments. This vulnerability enables attackers to delete any comment posted by any user, including entire comment threads, without needing special permissions. An attacker can obtain comment IDs from public listing pages and then delete them, disrupting user discussions and potentially silencing legitimate feedback.

## Quick answers

**Is CVE-2026-89262 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89262 being exploited in the wild.

**How severe is CVE-2026-89262?** High severity, with a CVSS score of 7.5, published 11 September 2026.

**Which products and versions are affected?** MoguBlog MoguBlog through 6.2.

**Is there a fix for CVE-2026-89262?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-89262 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-89262?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The comment deletion endpoint in MoguBlog's REST API performs authorization checks by comparing the request-body field commentVO.getUserUid() against stored ownership data, rather than validating the authenticated principal's identity. The /web/comment/delete endpoint is marked permitAll in WebSecurityConfig.java, meaning it accepts unauthenticated requests. Comment UIDs and author UIDs are publicly harvestable from the unauthenticated /web/comment/getList endpoint. An attacker can craft a DELETE request with arbitrary commentUid and userUid values to delete any comment and its child replies via soft-delete. No CVE patch status is documented in the advisory.

## Affected products

- MoguBlog MoguBlog through 6.2

## Timeline

- 2026-09-11: disclosed

## References

- [https://gitee.com/moxi159753/mogu_blog_v2/releases](https://gitee.com/moxi159753/mogu_blog_v2/releases)
- [https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C04_comment_delete_idor.py](https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C04_comment_delete_idor.py)