Is CVE-2026-89264 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-89264?

CVE-2026-89264 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-89264

Description

MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attributed to any other user. Attackers can supply arbitrary userUid values in the request body to impersonate other accounts including administrators.