CVE-2026-79323: n/a
Source CVE Database V5
Not known to be exploited · CVSS 7.5 High.
Data as of 10/25/2026, 04:40:14 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.5% chance of exploitation in 30 days – higher than 46% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Packagistmagefan/module-blog-graph-qlpkg:composer/magefan/module-blog-graph-qlOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Until a fix is available, consider restricting access to the /graphql endpoint or implementing additional access controls to prevent unauthenticated queries to the blogComments query. Monitor vendor channels for updates and apply official patches once released.
Description
Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 (magefan/module-blog-graph-ql) through 2.2.1 allows remote unauthenticated attackers to obtain blog commenter email addresses and internal customer and admin identifiers via a POST request to /graphql.
Impact
Successful exploitation results in unauthorized disclosure of sensitive information such as email addresses and internal identifiers related to customers and administrators. This can lead to privacy violations and potentially facilitate further targeted attacks or social engineering. There is no indication of impact on integrity or availability.
Weaknesses
- CWE-200Exposure of Sensitive Information to an Unauthorized Actor (opens in a new tab)
Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #20OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.