Description

Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 (magefan/module-blog-graph-ql) through 2.2.1 allows remote unauthenticated attackers to obtain blog commenter email addresses and internal customer and admin identifiers via a POST request to /graphql.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-09T19:17:48.020Z",
  "pubdate": "2026-09-09T19:17:48.020Z",
  "executiveSummary": "The Magefan Blog GraphQL extension for Magento 2 contains an information disclosure vulnerability within the blogComments query.\nThis vulnerability allows remote, unauthenticated attackers to query and extract sensitive user information, specifically commenter email addresses and internal identifiers for customers and administrative accounts.\nThe flaw stems from insufficient authorization checks within the GraphQL schema implementation, enabling unauthorized access to private data objects that should be restricted based on session or user privileges.\nImpact includes the mass harvesting of personally identifiable information (PII) and the exposure of internal system identifiers, which could facilitate further reconnaissance, social engineering, or targeted attacks against users and administrators.\nThe issue affects versions up to and including 2.2.1 of magefan/module-blog-graph-ql.\nExploitation requires no authentication and can be performed remotely via a crafted POST request to the /graphql endpoint.",
  "technicalDetails": "The vulnerability resides in the implementation of the blogComments query within the Magefan Blog GraphQL module. GraphQL interfaces provide a structured mechanism for querying specific data fields; however, in this instance, the resolver for the blogComments query fails to properly validate the authentication state and authorization scope of the requesting user.\nRoot Cause: The root cause is a lack of server-side access control in the query resolver. The backend logic retrieves data from the underlying Magento database and returns it in the GraphQL response without filtering the fields or verifying if the requester has the necessary permissions to view email addresses or internal system IDs associated with blog comments.\nAttack Flow: An attacker initiates a POST request to the /graphql endpoint of a Magento 2 instance equipped with the affected module. The attacker defines a GraphQL query targeting the blogComments field. Because the resolver does not enforce restrictive access policies, the server processes the request and serializes the requested fields—specifically the commenter email address and the associated customer or admin entity IDs—into the JSON response body.\nVulnerability Scope: This issue is present in versions up to 2.2.1. The attack is fully remote and does not require any prior authentication, making it accessible to any user capable of reaching the /graphql route.\nPayload Behavior: The attacker sends a crafted JSON payload containing the GraphQL query, such as { blogComments(postId: 1) { author_email, customer_id, admin_id } }. The server, failing to perform an access check, returns a response containing the PII of individuals who have previously interacted with the blog module, exposing internal user metadata that is intended for administrative view only.\nPost-Exploitation Impact: Successful exploitation results in the leakage of PII (email addresses) and internal identifiers. These internal identifiers provide attackers with a map of site users and administrative accounts, which can be utilized to craft spear-phishing campaigns, attempt account takeovers, or perform mapping of the system's administrative hierarchy. The exposure of email addresses also facilitates potential spamming or credential stuffing attacks against the affected Magento 2 users."
}