The Magefan team has released an urgent security patch for a vulnerability found in the Blog GraphQL module for Magento 2. The issue, tracked as CVE-2026-79323, allows unauthorized attackers to access sensitive information through GraphQL queries.
What Is the Vulnerability?
CVE-2026-79323 is an information disclosure flaw in the magefan/module-blog-graph-ql package. It affects Magento 2 users who have Magefan blog comments enabled with actual comment data. By sending a POST request to the /graphql endpoint, a remote attacker can retrieve the email addresses of commenters along with admin user IDs.
Who Is Affected?
The vulnerability impacts three Magefan modules:
- Magefan_BlogGraphQl
- Magefan_SecondBlogGraphQl
- Magefan_ThirdBlogGraphQl
If these modules are disabled in your installation and you do not use Magefan Blog comments, no action is required.
Recommended Actions
If you are affected, Magefan strongly recommends updating the modules to version 2.2.2 immediately.
Update via Composer:
Run the following commands from your Magento root directory:
composer require magefan/module-blog-graph-ql ^2.2.2
composer require magefan/module-secondblog-graph-ql ^2.2.2
composer require magefan/module-thridblog-graph-ql ^2.2.2
php bin/magento setup:upgrade
php bin/magento setup:di:compile
php bin/magento setup:static-content:deployAlternative: Manual Download
You can also download the latest version archives of the Blog GraphQL, Second Blog GraphQL, and Third Blog GraphQL modules and update them via FTP.
Temporary Workaround: Disable the Modules
If your application is not headless, you can disable the Blog GraphQL modules by editing the app/etc/config.php file in your Magento root directory and setting the following values to 0:
'Magefan_BlogGraphQl' => 0,
'Magefan_SecondBlogGraphQl' => 0,
'Magefan_ThirdBlogGraphQl' => 0,Summary
| Item | Details |
|---|---|
| CVE ID | CVE-2026-79323 |
| Vulnerability Type | Information Disclosure |
| Affected Modules | Blog GraphQL, Second Blog GraphQL, Third Blog GraphQL |
| Fix Version | v2.2.2 |
| Required Action | Update modules or disable if not needed |
Stay secure and keep your Magento store updated.