CVE-2026-109174: Incorrect Authorization in moxi624 MoguBlog

CVE-2026-109174 is an information disclosure vulnerability in MoguBlog through version 6.2. It allows attackers with low privileges (ordinary front-end users) to access the getSystemConfig endpoint and obtain unfiltered system configuration data. This data includes sensitive credentials such as Qiniu and MinIO secret keys and SMTP mailbox passwords, which should not be accessible to such users. The vulnerability has a CVSS 4.0 base score of 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required beyond a reader role, and no user interaction needed.

Exploitation of this vulnerability leads to unauthorized disclosure of sensitive system credentials, including cloud storage secret keys and email service passwords. This could enable attackers to access or manipulate backend services and email accounts, potentially leading to further compromise of the system or data leakage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the getSystemConfig endpoint to trusted users only and monitor for unusual access patterns. Avoid exposing sensitive configuration data to low-privileged users.