All vulnerabilities
CVE-2026-93366

Bludit CMS 3.22.0 Authorization Bypass via list-images/delete-image AJAX Endpoints

Bludit Bludit CMS
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.19%Chance of exploitation activity in the next 30 days, higher than 8% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published25 Sep 2026Updated 1 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

Bludit CMS through 3.22.0 contains an authorization bypass vulnerability that allows authenticated users with the Author role to enumerate and delete media files belonging to pages owned by other users, including administrators, by supplying arbitrary uuid parameters to unprotected AJAX endpoints. Attackers can retrieve page UUIDs for all users via the content-get-list endpoint and then submit crafted POST requests to the list-images and delete-image endpoints in bl-kernel/ajax/ to access and destroy media files outside their own pages, bypassing the IMAGE_RESTRICT isolation control.

Text from CVE List

Affected versions 3

  • Bludit CMSaffected: all versions through 3.22.0CVE List
  • Bludit CMSaffected: all versions through 4.0.0-beta-1CVE List
  • Bludit CMSaffected: all versions through 074773eff34b91c002ab9d99029a3edca4934bf1CVE List

References 2