Bludit CMS EUVD-2026-87209

Requires a valid authenticated account with the Author or Editor role on the target Bludit CMS (version through 3.22.0); the attacker must be able to reach the admin AJAX endpoint bl-kernel/ajax/content-get-list.php and issue a GET request with the parameter draft set to true. No user interaction from a victim is needed and default installations are affected once such an account exists. Limiting factors: exploitation is impossible for fully unauthenticated attackers, so risk depends on whether low-privilege accounts (self-registration, multi-author setups, or shared editorial teams) exist; impact is confined to disclosure of draft/scheduled content with no write or availability effect.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N, base 7.1) is internally consistent with the description: a network-reachable AJAX endpoint, low attack complexity, and low-privilege authentication (an Author or Editor account) yielding a confidentiality-only impact (VC:H, no integrity or availability effect). This is a genuine broken-access-control information-disclosure bug rather than a code-execution or takeover issue, so the 7.1 'High' rating is driven entirely by the confidentiality loss of site-wide private drafts. No EPSS score, CISA KEV entry, or SSVC decision data was supplied. A GitHub gist reference (akinerkisa) accompanies the VulnCheck advisory and appears to be proof-of-concept/write-up material, indicating publicly available exploit code exists; however, this is distinct from active exploitation, which is NOT confirmed by any KEV or vendor signal. Realistic priority is moderate: exploitation requires a pre-existing authenticated low-privilege account on the target Bludit instance, which sharply narrows the attacker population versus a fully unauthenticated flaw. Absent EPSS/KEV data, treat this as an opportunistic-insider or post-account-compromise risk rather than a mass-exploited internet-wide threat.

An attacker who already holds an Author or Editor account (self-registered, invited, or phished) on a Bludit site sends an authenticated GET request to bl-kernel/ajax/content-get-list.php with draft=true. The endpoint calls getList() without any ownership check and returns serialized page objects for the entire site, exposing administrators' unpublished drafts, scheduled posts, and sensitive pre-publication notes. Proof-of-concept material appears to exist publicly via a referenced gist, lowering the skill barrier.