CVE-2026-89261

EUVD-2026-76134
MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogu_search service without authentication, allowing remote attackers to delete, recreate, or alter the blog search index. Attackers can invoke POST endpoints to wipe the entire search index, delete specific documents, or inject malicious index entries, causing search functionality to return incorrect or no results.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://gitee.com/moxi159753/mogu_blog_v2/releases
https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C05_search_initElasticSearchIndex.py
https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C06_search_deleteElasticSearchByUids.py
https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C07_search_deleteElasticSearchByUid.py
https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C11_search_addElasticSearchIndexByUid.py
https://github.com/moxi624/mogu_blog_v2
https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_search/src/main/java/com/moxi/mogublog/search/config/WebSecurityConfig.java
https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_search/src/main/java/com/moxi/mogublog/search/restapi/ElasticSearchRestApi.java
https://www.vulncheck.com/advisories/mogublog-through-6.2-missing-authentication-for-elasticsearch-index-management-endpoints