CVE-2026-89261
MoguBlog through 6.2 Missing Authentication for Elasticsearch Index Management Endpoints
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogu_search service without authentication, allowing remote attackers to delete, recreate, or alter the blog search index. Attackers can invoke POST endpoints to wipe the entire search index, delete specific documents, or inject malicious index entries, causing search functionality to return incorrect or no results.
| CWE | CWE-306 |
| Vendor | moxi624 |
| Product | mogublog |
| Published | Sep 11, 2026 |
| Last Updated | Sep 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for moxi624 mogublog
Be the first to know when new medium vulnerabilities affecting moxi624 mogublog are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low
Affected Versions
moxi624 / MoguBlog
0 ≤ 6.2
References
github.com: https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C05_search_initElasticSearchIndex.py github.com: https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C06_search_deleteElasticSearchByUids.py github.com: https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C07_search_deleteElasticSearchByUid.py github.com: https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C11_search_addElasticSearchIndexByUid.py github.com: https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_search/src/main/java/com/moxi/mogublog/search/restapi/ElasticSearchRestApi.java github.com: https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_search/src/main/java/com/moxi/mogublog/search/config/WebSecurityConfig.java gitee.com: https://gitee.com/moxi159753/mogu_blog_v2/releases github.com: https://github.com/moxi624/mogu_blog_v2 vulncheck.com: https://www.vulncheck.com/advisories/mogublog-through-6.2-missing-authentication-for-elasticsearch-index-management-endpoints
Credits
🔍 Mingsheng Lin