A front‑end user with a standard reader session token can call the getSystemConfig endpoint in MoguBlog versions up to 6.2 to retrieve unfiltered system configuration data. The data includes secret keys for external services such as Qiniu and MinIO, as well as SMTP mailbox passwords. This disclosure can be used by an attacker to compromise remaining aspects of the site infrastructure and data stored or transmitted by those services.

The vulnerability exists in the MoguBlog project, versions 6.2 and earlier. No specific sub‑versions are listed; the reported impact applies broadly to all releases in that series.

The CVSS score of 7.1 indicates a high severity with moderate exploitation complexity and good network exposure. The EPSS score is not available, and the vulnerability is not currently listed in CISA’s KEV catalog. The attack would require only a valid, low‑privileged front‑end session token, which an attacker can obtain through standard user access or social engineering. Once the endpoint is accessed, the attacker can read plaintext credentials and subsequently use them to hijack storage, email, or other services.