GHSA-g478-vjq4-75hf: 
PHP vulnerability analysis and mitigation

Summary

The public GraphQL read queries of the blog module don't check publication state, store view or authorization. A request without any token can read content that the storefront itself hides.

Details

blogPosts only applies the filters the client sends. It never forces status = published or the current store view, so it returns every row in mageos_blog_post: drafts, scheduled posts, archived posts and posts assigned only to another store view. Each item includes the full content, the meta fields and the status. A client can also ask for the hidden rows on purpose with filter: { status: ... }. blogPost(id: ...) has the same gap. blogPost(url_key: ...) is scoped to the current store view, but it doesn't check the status either, so a draft is readable as soon as its URL key is known or guessed. blogCategories, blogCategory, blogTags, blogTag, blogAuthors and blogAuthor have the same gap for inactive entities. Categories and tags that belong only to another store view are returned too. The nested categories, tags and author fields on a post don't check whether the entity is active. The resolvers also never look at the blog's enabled setting, so a store that installed the module but hasn't switched the blog on (the default) is exposed as well. The create, update and delete mutations already require admin authorization and aren't affected. The storefront pages, the RSS feed, the sitemap and the search results check the post status, so the problem is limited to the GraphQL API. There's no REST API in the module.

Impact

Unauthenticated information disclosure. Unpublished content (drafts, scheduled announcements, archived posts) and content meant for a different store view can be read by anyone who can reach /graphql. There's no integrity or availability impact.

Patches

Fixed in 1.4.4. The list and detail queries now return only what the storefront shows: published posts, and active categories, tags and authors, restricted to the current store view. An admin token with the matching ACL resource (MageOS_Blog::post, MageOS_Blog::category, MageOS_Blog::tag, MageOS_Blog::author) can still read everything.

Workarounds

There's no configuration switch. Until you can update, block GraphQL requests that select the blogPost, blogPosts, blogCategory, blogCategories, blogTag, blogTags, blogAuthor or blogAuthors fields at the web server or WAF, or disable the module with bin/magento module:disable MageOS_Blog.