Authorization Bypass in Bludit CMS by Bludit

CVE-2026-93366

What is CVE-2026-93366?

Bludit CMS versions before 3.22.0 are vulnerable to an authorization bypass that permits authenticated users with the Author role to access and manipulate media files from pages owned by other users, including those of administrators. This is achieved by exploiting unprotected AJAX endpoints. Attackers can enumerate page UUIDs through the content-get-list endpoint and subsequently issue crafted POST requests to the list-images and delete-image endpoints, allowing unauthorized access and potential deletion of media assets beyond their own permissions, circumventing existing control measures.

References