MoguBlog up to version 6.2 has a broken access control flaw that permits an authenticated administrator to move, rename, or otherwise alter other administrators’ files on the network disk by supplying file paths. The flaw removes admin_uid checks in moveFile, batchMoveFile, and edit API calls, allowing attackers to relocate or rename files belonging to other users, potentially disrupting data integrity and modifying the file hierarchy without permission.

MoguBlog products from vendor moxi624 are affected whenever the software version is 6.2 or earlier. The vulnerability was discovered in the NetworkDiskRestApi and NetworkDiskServiceImpl code paths.

The vulnerability has a CVSS score of 5.3 and is not listed in CISA's KEV catalog. No EPSS score is publicly available. Exploitability requires possession of an authenticated administrator account; once obtained, the attacker can freely move or rename files belonging to other administrators. The risk is moderate, but the potential for disrupting critical data or confusing administrative workflows is significant.