CVE-2026-93364

Deferred Deferred - Pending Action

Bludit CMS Mass Assignment Vulnerability

Publication date: 2026-09-25

Last updated on: 2026-09-28

Assigner: VulnCheck

Description

Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows authenticated users with the Author role to modify privileged page fields reserved for administrators by injecting reserved parameters into a content save request. Attackers can submit reserved fields such as type and username through the Pages::edit() function in bl-kernel/pages.class.php, which iterates all fields declared in dbFields without per-field authorization, enabling an Author to convert pages to static site-wide navigation entries or transfer page ownership to arbitrary accounts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-28

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-93364

EUVD

EUVD-2026-87207

Affected Vendors & Products

Vendor	Product	Version / Range
bludit	bludit	to 3.22.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-915	The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Bludit CMS versions up to 3.22.0 have a mass assignment vulnerability. Authenticated users with the Author role can modify privileged page fields reserved for administrators by injecting reserved parameters into a content save request. This is done by submitting fields like type and username through the Pages::edit() function, which processes all fields in dbFields without checking per-field authorization. This allows an Author to change pages to static site-wide navigation or transfer page ownership to other accounts.

Detection Guidance

To detect this vulnerability, inspect Bludit CMS installations for unauthorized modifications to page fields. Check for changes in page ownership or type fields by reviewing database entries or admin logs. Look for requests to /admin/pages/save with reserved parameters like type or username in the payload.

Impact Analysis

An attacker with Author access could escalate privileges by converting pages to static navigation, altering site structure, or transferring page ownership to their account. This could lead to unauthorized content changes, defacement, or further compromise of the website or user accounts.

Compliance Impact

This vulnerability could lead to unauthorized modifications of website content or user data, potentially violating integrity and access control requirements in GDPR and HIPAA. Unauthorized changes may result in data breaches or non-compliance with data protection and security standards.

Mitigation Strategies

Upgrade Bludit CMS to a version later than 3.22.0 to address the mass assignment vulnerability. Ensure only trusted users have Author role privileges and review page ownership and type fields for unauthorized changes.

Hi! I’m here to help you understand CVE-2026-93364. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70