CVE-2026-109174

CVSS 7.1 (high) · published 2026-10-12

MoguBlog through 6.2 contains an information disclosure vulnerability that allows low-privileged front-end users to read system credentials via the getSystemConfig endpoint. Attackers can supply an ordinary reader session token to retrieve unfiltered SystemConfig data, exposing Qiniu and MinIO secret keys and SMTP mailbox passwords.

Weakness: CWE-863

Source: NVD CVE-2026-109174

References

• https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/mogu_blog_v2/poc_oauth_getSystemConfig.py
• https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_web/src/main/java/com/moxi/mogublog/web/restapi/AuthRestApi.java#L490-L502
• https://www.vulncheck.com/advisories/mogublog-through-6.2-credential-disclosure-via-oauth-getsystemconfig

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.