CVE-2026-109174

Versions of MoguBlog through 6.2 are vulnerable to an information disclosure vulnerability due to incorrect authorization (CWE-863) at the getSystemConfig endpoint. This flaw allows low-privileged front-end users to provide an ordinary reader session token to retrieve unfiltered SystemConfig data...