Description

MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by supplying comment UIDs and author UIDs obtained from unauthenticated listing endpoints.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-11T16:17:50.907Z",
  "pubdate": "2026-09-11T16:17:50.907Z",
  "executiveSummary": "MoguBlog through version 6.2 is susceptible to an authorization bypass vulnerability located within its comment management functionality.\nThe vulnerability is classified as an Insecure Direct Object Reference (IDOR) or improper authorization, arising from flawed logic in the ownership validation process during comment deletion.\nAn unauthenticated or authenticated attacker can leverage this flaw to delete any arbitrary comment and its associated replies across the platform.\nThe impact is significant, as it facilitates unauthorized content removal, potentially leading to mass censorship or data integrity destruction within the application.\nExploitation is highly accessible, as the necessary identifiers—specifically comment UIDs and author UIDs—can be harvested via unauthenticated API endpoints that list blog comments.\nNo elevated administrative privileges are required to perform this action; the application fails to verify the relationship between the session user and the resource being deleted, relying instead on user-supplied data in the request body.",
  "technicalDetails": "The vulnerability resides in the backend logic of the comment deletion endpoint. In typical secure implementations, an application should determine resource ownership by comparing the authenticated principal's session identifier against the owner ID stored in the database for the specific record.\nIn MoguBlog, the application performs an improper authorization check by trusting parameters provided directly within the request body. Instead of validating the session-derived identity, the system accepts user-provided UID fields (e.g., 'commentUid' and 'authorUid') as the authoritative source for verifying permission to delete a specific comment resource.\nThe exploitation flow begins with the attacker querying public, unauthenticated listing endpoints provided by MoguBlog. These endpoints return metadata for existing comments, including the required 'commentUid' and the associated 'authorUid'.\nOnce the attacker possesses these identifiers, they construct a malicious HTTP request directed at the comment deletion endpoint. By injecting the target 'commentUid' and the corresponding 'authorUid' into the request body, the attacker forces the application to evaluate the authorization check against the provided, attacker-controlled values rather than the actual user's session state.\nBecause the server-side code effectively performs a comparison between the attacker-supplied 'authorUid' and the 'authorUid' associated with the comment record, the check consistently returns true as long as the attacker provides the correct matching parameters retrieved during the enumeration phase.\nThis logic flaw allows the application to execute the deletion function, resulting in the permanent removal of the specified comment and all nested replies from the database. The vulnerability affects all versions of MoguBlog up to and including 6.2.\nThe exposure is network-wide, as the API endpoints are typically exposed to the public internet, and the requirement for a valid authenticated session is bypassed by the application's failure to enforce session-based ownership validation at the controller level."
}