Mass Assignment Vulnerability in Bludit CMS Affects User Privileges

CVE-2026-93364

What is CVE-2026-93364?

Bludit CMS versions through 3.22.0 are susceptible to a mass assignment vulnerability that allows authenticated users with the Author role to manipulate sensitive page fields typically reserved for administrators. This vulnerability enables attackers to inject reserved parameters, such as 'type' and 'username', into content save requests utilizing the Pages::edit() function within bl-kernel/pages.class.php. The function iterates through all fields without proper authorization for each field, potentially permitting an Author to modify pages into static, site-wide navigation entries or reassign page ownership to other accounts. This issue poses significant security risks and underscores the importance of implementing proper authorization checks in web applications.

References