Description

MoguBlog through 6.2 contains an authorization bypass vulnerability in the POST /pictureSort/getPictureSortByUid endpoint, which omits the @AuthorityVerify annotation required to enforce role-based permissions. Authenticated back-office users without image-category permissions can supply a category uid to retrieve restricted image-category records including metadata such as name, cover file uid, sort order and timestamps.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-11T16:17:51.337Z",
  "pubdate": "2026-09-11T16:17:51.337Z",
  "executiveSummary": "MoguBlog through version 6.2 is susceptible to an authorization bypass vulnerability within the administrative image management subsystem. The vulnerability stems from a failure to implement mandatory role-based access control (RBAC) checks on the POST /pictureSort/getPictureSortByUid endpoint. This security oversight allows authenticated back-office users—even those possessing limited privileges and lacking image-category management permissions—to execute authorized requests and retrieve sensitive metadata associated with restricted image categories.\nThe impact includes the unauthorized disclosure of administrative records, including cover file UIDs, sort configurations, and operational timestamps. By leveraging this flaw, an attacker with valid low-level backend credentials can map the internal organizational structure of image galleries. This exposure facilitates unauthorized information gathering, which could serve as a precursor to more severe administrative manipulation or reconnaissance within the MoguBlog platform. The flaw poses a moderate risk to data confidentiality and internal administrative integrity.",
  "technicalDetails": "The vulnerability is rooted in a missing implementation of the @AuthorityVerify annotation at the application level within the Spring Boot framework controllers. Specifically, the POST /pictureSort/getPictureSortByUid endpoint lacks the necessary AOP (Aspect-Oriented Programming) interceptor logic designed to validate the authenticated user's permissions against the requested resource.\nIn the intended security architecture, the @AuthorityVerify annotation acts as a gatekeeper that queries the user's role and permission sets before processing the request. Because this annotation is absent from the /pictureSort/getPictureSortByUid handler, the controller executes the business logic indiscriminately for any authenticated session, regardless of whether the user has been granted specific administrative rights to manage or view the target category records.\nThe attack flow follows a predictable pattern: 1) The attacker authenticates as a standard back-office user. 2) The attacker identifies the endpoint URL /pictureSort/getPictureSortByUid. 3) The attacker crafts a malicious POST request containing a specific 'uid' parameter corresponding to a target image-category record. 4) The application backend processes the request without checking if the user session has the 'image-category' privilege. 5) The server returns the sensitive metadata associated with the specified record to the unauthorized user.\nThe exploitation of this flaw does not require complex payload injection, as the issue is a logical authorization failure rather than a memory corruption or injection vulnerability. Successful exploitation exposes sensitive metadata, including internal system identifiers (cover file UIDs), data hierarchy (sort order), and management metadata (creation/modification timestamps). This data leakage provides an attacker with deep insights into the blog's backend structure, potentially exposing naming conventions or administrative workflows that can be leveraged for further target identification. The vulnerability is present in all versions of MoguBlog up to and including 6.2, and requires valid backend authentication to initiate the exploit."
}