MoguBlog through version 6.2 incorporates an insecure direct object reference flaw in the /networkDisk/getFileList endpoint. The endpoint accepts POST requests that filter files only by status, file type, or filePath, but it never verifies that the requesting administrator owns the files. As a result, an authenticated administrator can enumerate the file names and retrieve download URLs belonging to other administrators. This allows the attacker to read sensitive information, compromise privacy, and potentially obtain access to files that were not intended for the querying user. The vulnerability is a classic instance of CWE‑639, which can lead to a significant confidentiality breach without providing direct code execution.

The flaw affects MoguBlog installations up to and including version 6.2. Admin accounts with valid credentials can target the network-disk API, as the server-side code does not enforce ownership checks on file listings. Any MoguBlog instance that has the /networkDisk/getFileList endpoint enabled and allows administrative authentication is susceptible.

The CVSS score of 5.3 reflects a moderate impact severity; however, the lack of a public EPSS score suggests that large‑scale exploitation has not yet been observed. The vulnerability is not currently listed in the CISA KEV catalogue. Attackers would need valid administrator credentials (or compromised accounts) to access the endpoint. Once authenticated, the enumeration is straightforward and requires no additional privileges or system access beyond the standard administrative role. Because the flaw is limited to file metadata disclosure, the risk is primarily confidentiality loss, but the attack surface remains significant within administrative networks.