Executive brief
MoguBlog is an open-source blogging platform. An authenticated user can forge comments attributed to any other user, including administrators, by supplying arbitrary user IDs in the API request. This allows attackers to impersonate administrators in public forums, damage reputation, or create misleading content.
Technical details
The vulnerability exists in the POST /web/comment/add endpoint of MoguBlog through version 6.2. The application authenticates the incoming request (verifying the caller is a valid user), but then uses the userUid value from the request body rather than deriving it from the authenticated session context. This is a classic authorization bypass / insecure direct object reference (IDOR) in comment authorship. An authenticated attacker can construct requests with arbitrary userUid values to attribute comments to other users. The vulnerable code path is in CommentRestApi.java:610 where `comment.setUserUid(commentVO.getUserUid())` assigns the attacker-controlled value. While the actual caller's identity is logged separately (used for anti-spam decisions), the public comment display uses the spoofed userUid, resulting in impersonation visible to all readers.
Affected products
- MoguBlog MoguBlog through 6.2
Timeline
- 2026-09-11: disclosed