MoguBlog versions up to 6.2 contain an insecure direct object reference vulnerability that allows authenticated administrators to delete files belonging to other administrators through the /networkDisk/deleteFile and batchDeleteFile endpoints. The flaw exists because the backend service does not verify that the admin_uid of the requester matches the owner of the file, enabling the deletion of objects stored locally, on Qiniu, or on MinIO. This data loss can compromise business continuity and confidentiality when sensitive files are removed.

The affected product is MoguBlog, a content‑management platform developed by Moxi624, with all releases up to and including version 6.2 susceptible to this IDOR. No specific patch version is listed, indicating that the issue persists until a future update removes the missing ownership check.

The CVSS score of 5.3 signifies moderate severity, and the absence of an EPSS figure limits exposure metrics. Because the vulnerability requires authenticated administrator access, the attack surface is restricted to privileged accounts, who can exploit the unverified delete endpoints to erase files. The flaw is classified as a CWE‑639 Authorization Bypass through User‑Controlled Key, underscoring that proper access control is missing. While it is not currently listed in the CISA KEV catalog, the potential for data loss and workflow disruption warrants prompt remediation.