Bludit CMS CVE-2026-93366

Requires an authenticated account holding the Author role on a Bludit installation (through version 3.22.0); the attacker exploits the unprotected content-get-list, list-images, and delete-image AJAX endpoints in bl-kernel/ajax/ by supplying arbitrary uuid parameters, which defeats the IMAGE_RESTRICT per-user isolation control. Exploitation is limited to environments that grant untrusted users Author-level accounts; no admin privileges, user interaction, or non-default configuration are needed, but the requirement for a valid low-privileged login is the key limiting factor.

This is a genuine but moderate-severity issue. The vendor-supplied CVSS 4.0 vector (5.3, AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N) is internally consistent with the description: network-reachable AJAX endpoints, low attack complexity, and a required Author-level account (PR:L). No CISA KEV listing and no EPSS score are provided, so there is no evidence of widespread automated exploitation. However, a public proof-of-concept gist (akinerkisa) is referenced alongside the VulnCheck advisory, so publicly available exploit code exists - this raises practical exploitability above a theoretical-only finding, though it must not be conflated with active exploitation. The real-world risk is bounded by two factors: the attacker must already hold a valid authenticated Author account, and the impact is limited to reading/deleting media files rather than full site takeover or code execution. Net: a real, verifiable authorization-bypass (IDOR) worth patching, but not an emergency-priority remote-unauthenticated RCE. The one signal to verify is the tag 'Authentication Bypass', which misdescribes the flaw - this is an authorization (access-control) bypass per CWE-639, not an authentication bypass, since a valid login is required.

An attacker registers or obtains a low-privileged Author account on a Bludit site, then calls the content-get-list AJAX endpoint to harvest page UUIDs belonging to other users, including administrators. Using those UUIDs, they POST crafted requests to the list-images and delete-image endpoints in bl-kernel/ajax/ to enumerate and permanently destroy media files outside their own pages, bypassing the IMAGE_RESTRICT isolation control. A public proof-of-concept gist demonstrating the technique is referenced in the advisory.