CVE-2026-109174
6.5MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-863
Impact
Low-privileged front-end users can extract system credentials, including MinIO/Qiniu storage keys and SMTP passwords. Attackers only need network access and a valid reader session token.
Root cause
Improper authorization checks on the getSystemConfig API endpoint return unfiltered system configuration objects to standard users.
Affected systems
MoguBlog through version 6.2
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Fix & remediation
No fixed version is specified; block external access to the getSystemConfig endpoint at your reverse proxy or WAF until a patch is applied.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
MoguBlog through 6.2 contains an information disclosure vulnerability that allows low-privileged front-end users to read system credentials via the getSystemConfig endpoint. Attackers can supply an ordinary reader session token to retrieve unfiltered SystemConfig data, exposing Qiniu and MinIO secret keys and SMTP mailbox passwords.
References
- https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/mogu_blog_v2/poc_oauth_getSystemConfig.py
- https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_web/src/main/java/com/moxi/mogublog/web/restapi/AuthRestApi.java#L490-L502
- https://www.vulncheck.com/advisories/mogublog-through-6.2-credential-disclosure-via-oauth-getsystemconfig