Description

MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attributed to any other user. Attackers can supply arbitrary userUid values in the request body to impersonate other accounts including administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-11T16:17:51.193Z",
  "pubdate": "2026-09-11T16:17:51.193Z",
  "executiveSummary": "MoguBlog versions through 6.2 are affected by an Improper Authorization vulnerability within the comment submission mechanism.\nThe vulnerability resides in the POST /web/comment/add endpoint, which fails to enforce server-side validation of the author's identity.\nBy manipulating the userUid parameter in the request body, an authenticated user can perform an account impersonation attack, enabling the submission of comments attributed to any other user registered in the system, including those with administrative privileges.\nThis flaw presents a significant risk to the integrity and authenticity of user-generated content on the platform.\nSuccessful exploitation allows attackers to perform identity spoofing, potentially facilitating social engineering, defamation, or the unauthorized dissemination of information under the guise of legitimate, trusted, or administrative accounts.\nThe vulnerability requires the attacker to possess an active, authenticated user session within the MoguBlog platform to reach the target endpoint.",
  "technicalDetails": "The root cause of this vulnerability is an insecure implementation of user authorization logic during the processing of comment submissions. The application relies on client-provided data for identity attribution rather than deriving the author identity from a secure, server-side session context.\nSpecifically, the POST /web/comment/add endpoint accepts a JSON or form-encoded payload containing a userUid field. The backend server fails to verify if the provided userUid matches the authenticated principal associated with the active session token.\nThe attack flow begins with the attacker identifying a target user account or administrative account UID. Once authenticated to their own account, the attacker intercepts the request destined for the /web/comment/add endpoint. By injecting the target's userUid into the request body, the attacker forces the application to associate the comment with the impersonated account in the underlying database.\nThe vulnerable component is the server-side controller or service layer responsible for parsing and persisting comment data. Because the application logic trusts the user-supplied userUid blindly, it bypasses the necessary validation checks required to ensure that a user is only acting on their own behalf.\nThis issue is present in all versions of MoguBlog up to and including version 6.2. The lack of server-side session validation ensures that this bypass is trivial to execute once the attacker has authenticated, as no specific elevation of privilege is required to modify the POST request parameters.\nPost-exploitation impact is severe, as it subverts the trust model of the blogging platform. By impersonating administrative or high-reputation users, an attacker can manipulate discussions, deceive other platform users, and potentially gain access to sensitive areas of the site if the administration interface relies on comment-based interaction or trust metrics.\nThe exposure is limited to authenticated users; however, because the application fails to perform a cross-reference between the session-based user ID and the submitted payload ID, the security boundary is effectively rendered non-functional for this endpoint."
}