CyberRota Analysis
AI-GeneratedThe vulnerability affects MoguBlog versions up to 6.2, specifically in the POST /pictureSort/getPictureSortByUid endpoint, which lacks proper authorization checks. This allows authenticated back-office users to bypass role-based permissions and access restricted image-category records, potentially exposing sensitive metadata. Organizations using MoguBlog should prioritize patching this issue to prevent unauthorized data access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
MoguBlog through 6.2 contains an authorization bypass vulnerability in the POST /pictureSort/getPictureSortByUid endpoint, which omits the @AuthorityVerify annotation required to enforce role-based permissions. Authenticated back-office users without image-category permissions can supply a category uid to retrieve restricted image-category records including metadata such as name, cover file uid, sort order and timestamps.