The vulnerability allows an unauthenticated attacker to disable email notifications for any user by accessing the /web/comment/closeEmailNotification endpoint. This flaw enables the attacker to manipulate the startEmailNotification flag stored in the Redis cache, thereby suppressing reply notifications without proper authorization. The weakness is categorized as CWE-306, indicating missing authentication control.

The affected product is MoguBlog up to version 6.2, as provided by the CNA vendor moxi624. Any deployment of MoguBlog 6.2 or earlier that has not applied a later update is susceptible.

The CVSS score of 6.9 reflects a moderate level of severity; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by sending ordinary HTTP requests without valid credentials, enabling them to modify Redis entries for arbitrary users. Such exploitation does not require elevated privileges or additional discovery, making the attack path straightforward for any remote adversary with network access to the application.