Bludit Cms
Monthly
Bludit CMS through version 3.22.0 allows authenticated users with Author or Editor roles to read private drafts and scheduled posts belonging to any other user, including administrators, by sending a crafted request to the content-get-list AJAX endpoint. This missing authorization vulnerability (CWE-862) is network-reachable, requires low-privilege authentication, and results in high confidentiality impact with no integrity or availability effects. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated users holding the Author role on Bludit CMS through 3.22.0 can enumerate and delete media files attached to pages owned by other users, including administrators, by passing arbitrary uuid values to the unprotected content-get-list, list-images, and delete-image AJAX endpoints in bl-kernel/ajax/, which defeats the IMAGE_RESTRICT per-user media isolation control. The issue is a CWE-639 authorization bypass through a user-controlled key, rated CVSS v3.1 5.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and CVSS v4.0 5.3 (PR:L, VC:L, VI:L, VA:N) - a genuine but moderate-severity issue whose principal limiting factor is the need for a valid low-privileged login. No public exploit identified at time of analysis, and no confirmed actively exploited (CISA KEV) status applies.
Mass assignment in Bludit CMS 3.22.0 and earlier lets an authenticated user holding the low-privileged Author role tamper with page metadata that should be reserved for administrators. Because Pages::edit() in bl-kernel/pages.class.php writes every field listed in dbFields without per-field authorization, an Author can slip extra parameters such as 'type' and 'username' into an ordinary content-save request to convert a page into a static, site-wide navigation entry or reassign ownership of a page to an arbitrary account. The issue only matters on installations that hand Author-level accounts to untrusted users; it yields integrity-only impact with no confidentiality or availability effect and no code execution, and no public exploit code or confirmed active exploitation was identified at time of analysis (CVE-2026-93364, reported by VulnCheck, CWE-915).
Bludit CMS through version 3.22.0 allows authenticated users with Author or Editor roles to read private drafts and scheduled posts belonging to any other user, including administrators, by sending a crafted request to the content-get-list AJAX endpoint. This missing authorization vulnerability (CWE-862) is network-reachable, requires low-privilege authentication, and results in high confidentiality impact with no integrity or availability effects. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated users holding the Author role on Bludit CMS through 3.22.0 can enumerate and delete media files attached to pages owned by other users, including administrators, by passing arbitrary uuid values to the unprotected content-get-list, list-images, and delete-image AJAX endpoints in bl-kernel/ajax/, which defeats the IMAGE_RESTRICT per-user media isolation control. The issue is a CWE-639 authorization bypass through a user-controlled key, rated CVSS v3.1 5.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and CVSS v4.0 5.3 (PR:L, VC:L, VI:L, VA:N) - a genuine but moderate-severity issue whose principal limiting factor is the need for a valid low-privileged login. No public exploit identified at time of analysis, and no confirmed actively exploited (CISA KEV) status applies.
Mass assignment in Bludit CMS 3.22.0 and earlier lets an authenticated user holding the low-privileged Author role tamper with page metadata that should be reserved for administrators. Because Pages::edit() in bl-kernel/pages.class.php writes every field listed in dbFields without per-field authorization, an Author can slip extra parameters such as 'type' and 'username' into an ordinary content-save request to convert a page into a static, site-wide navigation entry or reassign ownership of a page to an arbitrary account. The issue only matters on installations that hand Author-level accounts to untrusted users; it yields integrity-only impact with no confidentiality or availability effect and no code execution, and no public exploit code or confirmed active exploitation was identified at time of analysis (CVE-2026-93364, reported by VulnCheck, CWE-915).