CVE-2026-93365 Bludit CVE debrief

Who should care

Defenders responsible for Bludit CMS installations, security teams, and administrators of Bludit CMS should assess exposure and prioritize verification. They should also restrict access to the content-get-list AJAX endpoint and monitor for suspicious activity. Additionally, defenders should review compensating controls for exposed systems and track exceptions, retest remediated assets, and close the item only after evidence is documented.

Why it matters

CVE-2026-93365 is a missing authorization vulnerability in Bludit CMS that allows authenticated users to access private drafts and scheduled posts. Defenders should prioritize verifying exposure, restricting access, and monitoring for suspicious activity.

• Potential unauthorized access to sensitive content
• Exposure of pre-publication material and administrator-owned drafts
• Verification of Bludit CMS installations for vulnerability
• Prioritization of updates or mitigations for affected systems

Technical summary

Bludit CMS through 3.22.0 contains a missing authorization vulnerability that allows authenticated users holding the Author or Editor role to read the full content of private drafts and scheduled posts belonging to any other user, including administrators. Attackers can send an authenticated GET request to the admin AJAX endpoint with the draft parameter set to true, triggering getList() without ownership constraints and returning serialized page objects site-wide, exposing pre-publication material and sensitive notes stored in administrator-owned drafts.

Defensive priority

Defenders should prioritize verifying exposure of Bludit CMS installations to unauthorized content access.

Recommended defensive actions

• Verify Bludit CMS installations for exposure to unauthorized content access
• Restrict access to the content-get-list AJAX endpoint
• Monitor for authenticated users with Author or Editor roles
• Update Bludit CMS to the latest version if available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the missing authorization vulnerability in Bludit CMS. The vulnerability allows authenticated users to access private drafts and scheduled posts. Defenders should verify exposure and restrict access to the content-get-list AJAX endpoint. The CVE record was published on 2026-09-25T17:17:19.487Z and has not been modified since then. There are no known exploits or reports of this vulnerability being used in attacks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.