CVE-2026-93364 Bludit CVE debrief

Who should care

Bludit CMS administrators, security teams, and developers responsible for maintaining and securing Bludit CMS installations should assess exposure and prioritize remediation. This includes reviewing the official advisory and CVE record to validate affected scope and severity, and planning vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

CVE-2026-93364 is a medium-severity vulnerability in Bludit CMS that allows authenticated users with the Author role to modify privileged page fields. This could lead to unauthorized changes and potential privilege escalation. Bludit CMS administrators and security teams should assess exposure and prioritize remediation.

• Potential unauthorized modification of privileged page fields
• Possible elevation of Author role privileges
• Risk of site-wide navigation entry creation by non-admin users
• Potential for arbitrary account takeovers through page ownership transfer

Technical summary

The Pages::edit() function in bl-kernel/pages.class.php does not enforce per-field authorization, allowing Author role users to inject reserved parameters into a content save request. This could enable an Author to modify privileged page fields, convert pages to static site-wide navigation entries, or transfer page ownership to arbitrary accounts. The vulnerability has a CVSS score of 5.3 and a medium severity, indicating a moderate level of risk to Bludit CMS installations. Administrators and security teams should review the official advisory and CVE record to validate affected scope and severity.

Defensive priority

Medium priority for Bludit CMS administrators and security teams

Recommended defensive actions

• Review and restrict the Pages::edit() function in bl-kernel/pages.class.php to enforce per-field authorization
• Limit the privileges of authenticated users with the Author role
• Monitor for suspicious page modifications and ownership changes
• Update to a version of Bludit CMS that addresses this vulnerability, if available
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is confirmed in Bludit CMS version 3.22.0. Details are from the CVE Program and NVD records, as well as references from Vulncheck. The CVE record was published on 2026-09-25T17:17:19.307Z and has not been modified since then. There are limited details available about the specific exploitation of this vulnerability in the wild, but defenders should verify the affected scope and severity based on the official advisory and CVE record.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.