CVE-2026-89265 describes an authorization bypass vulnerability in MoguBlog through version 6.2. The POST /pictureSort/getPictureSortByUid endpoint does not enforce role-based access control due to the omission of the @AuthorityVerify annotation. As a result, authenticated back-office users who lack image-category permissions can supply a category uid and retrieve restricted image-category records, including metadata such as name, cover file uid, sort order, and timestamps.

The vulnerability allows authenticated back-office users without the necessary permissions to access restricted image-category metadata. This leads to unauthorized disclosure of information such as category names, cover file identifiers, sort orders, and timestamps. There is no indication of impact on data integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint to only authorized users and monitor for unauthorized access attempts.