CVE-2026-93366 Bludit CVE debrief

Who should care

Bludit CMS administrators, security teams, and users with the Author role should assess exposure and verify proper authorization for media file access and deletion. They should review and restrict access to the content-get-list, list-images, and delete-image AJAX endpoints, verify and enforce proper authorization for media file access and deletion, and monitor for suspicious activity on the Bludit CMS instance.

Why it matters

The CVE-2026-93366 authorization bypass vulnerability in Bludit CMS allows authenticated users to access and delete media files belonging to other users, which can lead to unauthorized data access and deletion.

• Authenticated users with the Author role can access media files outside their own pages
• Media files belonging to pages owned by other users, including administrators, can be deleted
• The vulnerability bypasses the IMAGE_RESTRICT isolation control
• Verification of proper authorization and access controls is required

Technical summary

The Bludit CMS through 3.22.0 contains an authorization bypass vulnerability that allows authenticated users with the Author role to enumerate and delete media files belonging to pages owned by other users, including administrators. The vulnerability bypasses the IMAGE_RESTRICT isolation control, allowing unauthorized data access and deletion. Attackers can retrieve page UUIDs for all users via the content-get-list endpoint and then submit crafted POST requests to the list-images and delete-image endpoints in bl-kernel/ajax/ to access and destroy media files outside their own pages.

Defensive priority

Medium priority for Bludit CMS administrators and security teams

Recommended defensive actions

• Review and restrict access to the content-get-list, list-images, and delete-image AJAX endpoints
• Verify and enforce proper authorization for media file access and deletion
• Monitor for suspicious activity on the Bludit CMS instance
• Update Bludit CMS to the latest version if available
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the authorization bypass vulnerability in Bludit CMS. However, the corpus does not establish versions beyond 3.22.0, exploitation, impact, or remediation, which require verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.