{"uuid": "7ea7e879-702d-458e-82e2-840e3ac4bb9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-79323", "type": "seen", "source": "https://gist.github.com/mrtantoine/4331a5f04f8309eb1799b257a7371f34", "content": "# CVE-2026-79323 \u2014 Information Disclosure in Magefan Blog GraphQL for Magento 2 through 2.2.1\n\n## Summary\n\nInformation disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 (magefan/module-blog-graph-ql) through 2.2.1 allows remote unauthenticated attackers to obtain blog commenter email addresses and internal customer and admin identifiers via a POST request to /graphql.\n\n## Affected\n\n- Product: Magefan Blog GraphQL for Magento 2 (magefan/module-blog-graph-ql)\n- Versions: through 2.2.1 (current latest release, published 2026-06-24; no fixed version available). Requires magefan/module-blog, tested with 2.13.1 (latest).\n- Authentication required: none (unauthenticated)\n\n## Details\n\nThe blogComments query is declared as a top-level Query field in etc/schema.graphqls with a resolver and no access directive. Model/Resolver/Comments.php builds its search criteria from only two constraints, status and the caller-supplied post_id, with no per-user scoping and no field allowlist, so raw comment rows including author_email are serialized to any anonymous caller.\n\nVerified on a local Mage-OS lab with Magefan Blog 2.13.1 and Blog GraphQL 2.2.1 (both latest). Unauthenticated response:\n\n{\"data\":{\"blogComments\":{\"items\":[{\"comment_id\":1,\"author_nickname\":\"VictimNick\",\"author_email\":\"victim-SECRET-email@private.example\",\"customer_id\":0,\"admin_id\":0}]}}}\n\nThe email is not otherwise public: the shipped comment display template view/frontend/templates/post/view/comments/magefan/comment.phtml renders only the nickname, the publish date and the comment text. author_email appears only as a submit-form input name in magefan.phtml. This control is a static verification of the shipped templates; the blog front-end route was not enabled on the test instance.\n\n## Attack vector\n\nSingle unauthenticated HTTP POST to /graphql with a blogComments query requesting the author_email field. No Authorization header, no cookie, no session, no user interaction. Iterating post_id harvests every approved commenter email on the site.\n\n## Impact\n\nAn unauthenticated attacker can enumerate blog posts and harvest the email addresses of every commenter, along with the internal customer_id and admin_id that tie a comment to a registered customer or an admin user. Under GDPR these are personal data.\n\n## CVSS 3.1\n\nAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3 (Medium)\n\n## Remediation\n\nDo not expose author_email, customer_id and admin_id on the anonymous blogComments query. Either remove these fields from the public BlogComment GraphQL type, or gate them behind an authenticated and authorized resolver, or strip them in the data provider before returning results to unauthenticated callers.\n\n## References\n\n- https://magefan.com/magento2-blog-extension\n- CWE-862 Missing Authorization\n- CWE-639 Authorization Bypass Through User-Controlled Key\n\n## Credit\n\nDiscovered by Antoine Morato.", "creation_timestamp": "2026-09-08T21:28:11.522958Z"}