A missing authorization guard on the POST /pictureSort/getPictureSortByUid endpoint allows an authenticated back‑office user who lacks image‑category permissions to supply a category uid and retrieve restricted image‑category records, including names, cover images, sort order, and timestamps. The flaw is a direct instance of improper authorization (CWE‑862) and results in unauthorized data disclosure rather than code execution. The attacker gains visibility into organizational image data and can use the returned metadata to map internal structures or facilitate further attacks if additional credentials are compromised.

The vulnerability affects MoguBlog versions up to and including 6.2. Users running any 6.x release from the start of the 6.x series through 6.2 are potentially impacted. The specific product is MoguBlog, maintained by the Moxi624 project. Versions earlier than 6.3 contain the vulnerability; later releases have remedied the missing annotation.

The CVSS score of 5.3 indicates moderate potential impact, largely limited to data exposure. Because the attack requires an authenticated back‑office user, an adversary must first compromise legitimate credentials or obtain access to a back‑office account. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalogue, suggesting no currently known public exploitation. Nonetheless, the lack of role verification poses a tangible risk to confidentiality for organizations that rely on strict separation of image‑category management. The likely attack vector is through normal application usage by an insider or credentialed attacker, making it easier to discover and exploit without external network barriers.