CVE-2026-109175: Authorization Bypass Through User-Controlled Key in moxi624 MoguBlog

CVE-2026-109175 is an authorization bypass vulnerability in MoguBlog through version 6.2. Authenticated administrators can exploit the insecure direct object reference in the POST /networkDisk/getFileList endpoint, which fails to restrict file listings by admin_uid. This allows them to enumerate and access other administrators' network-disk files by manipulating the request parameters, bypassing intended access controls.

An authenticated administrator can list and potentially download files belonging to other administrators on the network disk. This could lead to unauthorized disclosure of sensitive files stored by other administrators. The vulnerability does not allow privilege escalation beyond authenticated administrator access, but it compromises confidentiality among administrators.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and monitor for suspicious access patterns to the /networkDisk/getFileList endpoint. Avoid sharing administrator credentials and consider additional access control mechanisms if possible.