Tegalog flaw lets anyone log in as admin (CVE-2026-64940)

On July 29, 2026, Japan's national vulnerability portal JVN published an advisory for Tegalog, a posting tool widely used on personal websites in Japan. A third party who has not logged in can get into the admin screen. The severity score is 8.8 out of 10.

Every version distributed before June 29, 2026 is affected. This is not "only 4.8.4 is at risk." Every release from Ver 1.0.0 through Ver 4.8.4 is included. Only Ver 4.9.0 is safe.

And here is the part that matters most. The fix has been available for a month already. The developer shipped 4.9.0 on June 29 and has repeatedly urged users never to keep running older versions. Today's JVN publication is the official confirmation, arriving a month later. If your installation is still on an old version, you are already a month behind.

What Tegalog is, and who runs it

Tegalog is a free posting tool distributed by Nishishi Factory (Fumihiro Nishimura). Install it on your own site and you get a private timeline for short posts and images — essentially a personal microblog. No database is required; you upload eight files to a shared hosting account and it runs.

The people running it are not corporate IT administrators. They are individuals running personal sites and fan sites — people who stepped back from social networks and returned to their own corner of the web, people who want an update log, people who post illustrations. It has spread quickly in that community over the past few years. On July 11 a directory of Tegalog user sites called Tegalink opened, and by July 27 it listed 199 sites.

In other words, the affected population is sites with no dedicated administrator. Not people who track vulnerability feeds daily, but people who keep a website as a hobby. That is where this 8.8 sits.

What an attacker can do

JVN's wording is brief: "A third party who can access the product may log in to the administration screen. As a result, any operation available on the administration screen may be performed."

Put plainly, everything the site owner can do, an outsider can do. Editing and deleting posts, changing settings, uploading files such as images, adding user accounts. The skin that controls how pages look can be swapped out as well. "A third party who can access the product" means, in practice, anyone at all if the installation is reachable on the public internet.

The 8.8 comes from CVSS, the international scoring method, and reading the breakdown shows where the number comes from. It can be attacked over the network, needs no special conditions, requires no prior login, and requires nothing from the administrator — near-perfect marks on all of those, while the amount of information directly exposed is rated low. It helps to think of this as a score built out of how easy it is to get in, rather than how much is stolen at the moment of entry.

The classification is CWE-625, an overly permissive regular expression. A regular expression is a way of describing the shape of a string, used for checks like "does this input match the expected pattern." When the pattern is too loose, input that should be rejected gets through. A classic case is forgetting to anchor the start and end of the string, so that "matches somewhere in the middle" counts as a pass.

That said, exactly where Tegalog's pattern was too loose has not been disclosed. The developer has not described the mechanism, and JVN goes no further than the classification. With a large number of installations still unpatched, spelling out the technique would amount to publishing an attack guide. Leaving it unknown is the correct state right now, and this article will not speculate either.

The issue was found and reported by Yuji Tonouchi of Mitsui Bussan Secure Directions. It travelled the proper route: reported through IPA's vulnerability reporting scheme, passed to the developer, and published on JVN after the fix shipped.

Who targets this, and why

If you run a personal site, the natural reaction is "who would bother attacking something this small?" This is the most commonly misunderstood part. What is coming for you is not a human interested in your site, but automated software sweeping the entire internet for the same hole. It does not read your content. It reads one thing: whether an old copy of Tegalog is sitting there.

What happens next is fairly standardized too. Hidden links and ads pointing to other sites get planted, and files get dropped on the server to use it as a stepping stone for the next attack — those two account for most cases. Staying quiet pays better than visible vandalism, because visible damage gets noticed and cleaned up.

The damage lands on both the owner and the visitors. For an owner, the worst outcome is years of posts being wiped or rewritten at once. Tegalog is typically used as a daily record, and that kind of data does not come back. On top of that, planted files can get your hosting account suspended, and if search engines flag the site as dangerous, visitors start seeing browser warnings before they reach it. For visitors, it shows up as opening a site they read every day and being bounced somewhere unfamiliar.

The shape of this problem — an admin screen reachable from outside, with a hole in the door — is not unusual. We have covered a Pi-hole flaw that let the admin panel be taken over without a password and a WireGuard Easy flaw that exposed connection details through its admin screen. The difference here is that those were tools for technical users, while this one is a tool for people who are not.

Your version number is visible from outside

There is a second reason to hurry. Both the presence of Tegalog and its version can be checked from outside the site.

First, the admin login page displays the version number directly. Open the admin screen of the Tegalog instance the developer uses for release notes and you will see "てがろぐ Ver 4.9.0" printed alongside the login fields. Every installation shows the same format.

Second, the condition for free use is that the page must carry a "Powered by Tegalog" credit and link (a separate license is available for organizations that want to remove it). As licensing terms go this is entirely ordinary, and the developer has done nothing wrong. But the effect is that sites running Tegalog announce themselves.

In practice, search engines have indexed login screens still running old versions. While researching this article, pages still on the 4.0 and 4.2 series turned up in search results (we are not naming them here). Take away only this: if someone goes looking, these installations can be found.

None of this is a criticism of the developer or of users. It is the opposite — it is precisely why every day after publication works against you. From today, the existence of this flaw is public knowledge available to anyone. Updating today is the cheapest version of this problem you will get.

What happened during the missing month

The developer responded quickly and thoroughly. What lagged was the official disclosure. Here is the sequence.

← Swipe to move

How you read that month depends on where you stand. Through the June 29 release announcement and the advisory page published the next day, the developer pushed as hard as one person can. The instructions are generous, down to "check the ones you are not using." By any reasonable standard, the vendor side did its job.

People still did not get the message. Tegalog is the kind of software that keeps running after you stop looking at it. On a site nobody has touched in years, there is simply no occasion to visit the official page. Today's JVN publication is one of the few remaining ways to reach those owners.

Publication hands information to the other side at the same time, though. As of this writing, neither the developer nor JVN has reported any abuse. The accurate reading is that today is the window in which you can still act before anything has happened.

How to update

You can jump straight to 4.9.0 from any version. Posts and settings carry over untouched. There is no need to step through intermediate releases.

The easiest route is a button in the admin screen. Tegalog ships with an updater called TegUp; if it is installed, an "update now" button appears in the admin screen and one click swaps in the latest version.

If that button is not there, replace the files by hand. Download the latest ZIP from the distribution page and upload tegalog.cgi, fumycts.pl and tegup.php over the ones in your existing Tegalog directory. Leave configuration and data files alone. After overwriting, confirm that the CGI file permissions still match what they were before.

And here is the point the developer stresses most. Try to remember whether you have Tegalog installed in more than one place. One for the main site and one for a diary; a test copy dropped in another directory years ago and forgotten. The ones you no longer use are sitting there with the same hole, still publicly reachable. If you have no plans for them, deleting the files outright is safer than updating them.

How to check whether someone already got in

To be straight about it: the developer has not published a way to check for traces. With the technical detail withheld, there is no published indicator that definitively says "you were breached." The list below is what one generally checks after this class of intrusion.

It is also worth changing your password after updating. This flaw does not steal passwords, but if someone reached the admin screen, anything could have happened from there. If you reuse that password elsewhere, change it there too.

Summary

Tegalog, a posting tool used across personal and fan sites in Japan, has a published vulnerability (CVE-2026-64940) that lets someone into the admin screen without logging in. Severity 8.8. Every release up to and including Ver 4.8.4 is affected; only Ver 4.9.0, released June 29, 2026, is safe.

There is one action item. Look at the version shown on your admin screen, and if it is not 4.9.0, update today. One click if the button is there, three overwritten files if it is not. While you are at it, check whether you have another Tegalog somewhere you forgot about.

The developer has been sounding the alarm for a month. What is late here is the disclosure, not the response. No abuse has been reported yet, but because installations advertise themselves along with their version number, time stops being on your side once the flaw is public. We will update this article as new information appears.

References

• ▸ JVN#99975039 - Tegalog (Fumy Otegaru Memo Logger) uses an overly permissive regular expression
• ▸ CVE.org - CVE record for CVE-2026-64940
• ▸ Nishishi Factory - Tegalog vulnerability report and advisory (2026-06-29)
• ▸ Nishishi Factory - Announcement of Tegalog Ver 4.9.0
• ▸ Nishishi Factory - Tegalog release notes
• ▸ Nishishi Factory - Tegalog, a lightweight microblog CGI
• ▸ Nishishi Factory - TegUp (one-click updater)
• ▸ Tegalink - directory of Tegalog user sites
• ▸ MITRE - CWE-625: Permissive Regular Expression
• ▸ IPA - Vulnerability information reporting scheme