MoguBlog versions prior to 6.2 allow an attacker to delete any comment or reply by crafting a request that provides the comment UID and author UID in the request body. The server checks ownership against these supplied fields rather than the authenticated user identity, resulting in an authorization bypass that can remove content from the blog. This flaw permits direct data modification, compromising the integrity of user-generated content.

The vulnerability affects the MoguBlog project, specifically integrations using versions 6.2 or earlier. The affected endpoints include the comment deletion REST API that accepts comment ID and author ID in the request payload. No other MoguBlog subsystems are directly noted as impacted.

With a CVSS score of 8.7, this flaw is considered high severity. The EPSS score is not available, and it is not listed in CISA’s KEV catalog, indicating current public exploitation data is lacking. However, the exploit path is straightforward: an attacker can obtain comment identifiers from public listing endpoints without authentication and then send a deletion request that passes the flawed ownership check. The likely attack vector is a targeted HTTP request to the deletion endpoint, and the impact is local to the affected blog instance, potentially erasing community discussions.