CVE-2026-93364
Bludit CMS 3.22.0 Mass Assignment Privilege Escalation via Pages::edit()
Bludit Bludit CMS
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.19%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows authenticated users with the Author role to modify privileged page fields reserved for administrators by injecting reserved parameters into a content save request. Attackers can submit reserved fields such as type and username through the Pages::edit() function in bl-kernel/pages.class.php, which iterates all fields declared in dbFields without per-field authorization, enabling an Author to convert pages to static site-wide navigation entries or transfer page ownership to arbitrary accounts.
Text from CVE List
Affected versions 3
- Bludit CMSaffected: all versions through 3.22.0CVE List
- Bludit CMSaffected: all versions through 4.0.0-beta-1CVE List
- Bludit CMSaffected: all versions through 074773eff34b91c002ab9d99029a3edca4934bf1CVE List