Description

MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. Remote callers can modify the startEmailNotification flag in Redis cache for any user identifier to suppress reply notifications without authorization.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-11T16:17:51.053Z",
  "pubdate": "2026-09-11T16:17:51.053Z",
  "executiveSummary": "MoguBlog versions through 6.2 contain an improper access control vulnerability within the email notification management system. The vulnerability resides in the /web/comment/closeEmailNotification endpoint, which fails to perform necessary authentication or authorization checks on incoming requests.\nThis security flaw allows remote, unauthenticated attackers to manipulate the user-specific email notification settings stored within the Redis cache. By interacting directly with this endpoint, an attacker can modify the 'startEmailNotification' flag for any arbitrary user identifier without requiring valid session tokens or administrative privileges.\nThe primary risk implication involves the unauthorized suppression of system-generated communications, such as comment reply notifications. This impacts the integrity of user communication preferences and potentially facilitates social engineering or service disruption by silencing important account alerts. The vulnerability is externally exploitable over the network, requiring no prior authentication, posing a significant risk to the availability and reliability of the platform's notification services.",
  "technicalDetails": "The vulnerability is rooted in an authentication bypass mechanism within the MoguBlog backend API, specifically targeting the /web/comment/closeEmailNotification endpoint. Analysis reveals that the application logic fails to implement identity verification checks to ensure that the requester possesses the authorization to modify settings for the targeted user ID.\nThe exploitation flow begins when an attacker identifies a target user identifier. The attacker then crafts an HTTP request directed at the /web/comment/closeEmailNotification endpoint. Due to the absence of middleware-level authentication enforcement, the backend processes the request as if it originated from an authorized user or internal administrative process.\nUpon receiving the request, the application interacts with the Redis cache, which serves as the persistence layer for notification preferences. The vulnerable function updates the 'startEmailNotification' boolean flag associated with the provided user identifier. By setting this value to 'false', the attacker effectively disables email notifications for that specific user account.\nBecause the system performs a direct state mutation based on the provided identifier without validating the current user context (e.g., matching a session identifier to the target ID), the attack remains highly effective for any user identifier accessible via the platform. This vulnerability indicates a critical lack of input validation and session authorization in the API design.\nAffected systems include all MoguBlog versions up to and including 6.2. The attack is executable from a remote network environment, necessitating only knowledge of the API structure and target identifiers. The payload behavior is strictly limited to cache modification, which serves as a post-exploitation impact by suppressing legitimate system communications, thereby hindering user interaction and potentially assisting in campaigns that rely on keeping users unaware of account or comment activity."
}