CVE-2026-109175 MoguBlog through 6.2 Broken Access Control via /networkDisk/getFileList

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POST /networkDisk/getFileList. Attackers can query the endpoint, which filters only by status, file type, or filePath and...