The Magefan team has been notified about the security issue CVE-2026-79323 in the Magento 2 Blog GraphQL module. Having conducted a thorough investigation, we confirmed the reported concern and prepared a fix.

What is CVE-2026-79323?

CVE-2026-79323 is an information disclosure issue in the Blog GraphQL module (magefan/module-blog-graph-ql), affecting the Magento 2 Blog Extension, Magento 2 Second Blog Extension and Magento 2 Third Blog Extension users who have Magefan blog comments enabled with actual blog post comments data. 

Remote unauthorized attackers can call queries to /graphql via a POST request and receive the commenter's email address, along with the admin user IDs. 

What Should You Do?

If the Magefan_BlogGraphQl, Magefan_SecondBlogGraphQl, and Magefan_ThirdBlogGraphQl modules are disabled in your installation and you do not use Magefan Blog comments, no further action is required. Otherwise, refer to the suggestions below.

First and foremost, we recommend updating the Blog GraphQL, Second Blog GraphQL, and Third Blog GraphQL modules to v2.2.2.  To update the modules via Composer, run the following commands:

composer require magefan/module-blog-graph-ql ^2.2.2
composer require magefan/module-secondblog-graph-ql ^2.2.2
composer require magefan/module-thridblog-graph-ql ^2.2.2

php bin/magento setup:upgrade
php bin/magento setup:di:compile
php bin/magento setup:static-content:deploy

Alternatively, you may download the latest version archives of the Blog GraphQL, Second Blog GraphQL, and Third Blog GraphQL modules and update them via FTP.

Secondly, if your application is not headless, you can disable the Blog GraphQL modules in the app/etc/config.php file of your Magento root directory:

'Magefan_BlogGraphQl' => 0,
'Magefan_SecondBlogGraphQl' => 0,
'Magefan_ThirdBlogGraphQl' => 0,

The Magefan team is committed to responding to security reports, investigating them, and providing the necessary fixes. Keeping our extensions secure is our core priority. 

If you have any security concerns regarding our extensions, please contact us. We appreciate every report that keeps things safe for everyone.