# CVE-2026-89264: MoguBlog comment author spoofing via identity confusion

Source: https://junglewise.ai/threats/cve-2026-89264-mogublog-comment-author-spoofing-via-identity-confusion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-11. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-89264 · Severity: medium · CVSS 4.3 · Published 2026-09-11

MoguBlog is an open-source blogging platform. An authenticated user can forge comments attributed to any other user, including administrators, by supplying arbitrary user IDs in the API request. This allows attackers to impersonate administrators in public forums, damage reputation, or create misleading content.

## Quick answers

**Is CVE-2026-89264 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89264 being exploited in the wild.

**How severe is CVE-2026-89264?** Medium severity, with a CVSS score of 4.3, published 11 September 2026.

**Which products and versions are affected?** MoguBlog MoguBlog through 6.2.

**Is there a fix for CVE-2026-89264?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-89264 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-89264?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the POST /web/comment/add endpoint of MoguBlog through version 6.2. The application authenticates the incoming request (verifying the caller is a valid user), but then uses the userUid value from the request body rather than deriving it from the authenticated session context. This is a classic authorization bypass / insecure direct object reference (IDOR) in comment authorship. An authenticated attacker can construct requests with arbitrary userUid values to attribute comments to other users. The vulnerable code path is in CommentRestApi.java:610 where `comment.setUserUid(commentVO.getUserUid())` assigns the attacker-controlled value. While the actual caller's identity is logged separately (used for anti-spam decisions), the public comment display uses the spoofed userUid, resulting in impersonation visible to all readers.

## Affected products

- MoguBlog MoguBlog through 6.2

## Timeline

- 2026-09-11: disclosed

## References

- [https://gitee.com/moxi159753/mogu_blog_v2/releases](https://gitee.com/moxi159753/mogu_blog_v2/releases)
- [https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C12_comment_add_author_spoof.py](https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C12_comment_add_author_spoof.py)