Bludit CMS CVE-2026-95153

Exploitation requires an authenticated session with high privileges in the Bludit admin interface (PR:H), since both affected endpoints live under the authenticated /admin/ajax/ path; a fully unauthenticated attacker cannot reach them. Specifically, the attacker must be able to invoke the /admin/ajax/clippy and /admin/ajax/save-as-draft AJAX handlers of Bludit CMS 3.22.0. No user interaction is required (UI:N) and attack complexity is low (AC:L), but the need for existing privileged admin-area access is the primary limiting factor; impact is confined to disclosure of sensitive information (C:H), with no integrity or availability effect.

This is a moderate-severity information disclosure flaw (CVSS 4.9) whose real-world priority is limited by its access requirements. The provided CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N indicates a network-reachable, low-complexity attack, but PR:H means the attacker must already hold high (authenticated) privileges in the Bludit admin area before reaching the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints, sharply reducing the attacker population. No EPSS score, no CISA KEV listing, and no public POC were supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The only reference is a third-party GitHub issue (lushibin000/CVE), not a vendor advisory, so impact scope (C:H, I:N, A:N - confidentiality only) rests on MITRE's assignment rather than independent confirmation. Signals are internally consistent (authenticated info disclosure, confidentiality-only impact) rather than conflicting, but the overall picture is a genuine-but-low-urgency issue: a real flaw gated behind existing privileged access in a niche CMS, not a mass-exploitation priority.

An attacker who has already authenticated to the Bludit admin panel as a privileged user issues crafted requests to the /admin/ajax/clippy or /admin/ajax/save-as-draft AJAX endpoints and receives sensitive information that should not be exposed to their session. No public exploit code was identified, and the CVSS low attack complexity suggests the request itself is straightforward once admin-area access is obtained.