CVE-2026-88421 is an incorrect access control vulnerability in the BlogPage.get_entries() component of APSL puput versions 1.2.1 through 2.2.0. It permits unauthenticated attackers to access restricted blog entries via multiple interfaces including the blog index, tag, category, author and date archives, sidebar widgets, and RSS feed. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity due to its network attack vector, low attack complexity, no privileges required, and no user interaction needed. The impact is limited to confidentiality, with no integrity or availability impact reported.

The vulnerability allows unauthorized disclosure of restricted blog content, compromising confidentiality. There is no reported impact on data integrity or system availability. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, restrict access to affected components or implement additional access controls as a temporary mitigation.