CVE-2026-93365

Deferred Deferred - Pending Action

Bludit CMS Missing Authorization in Draft Content Exposure

Publication date: 2026-09-25

Last updated on: 2026-09-28

Assigner: VulnCheck

Description

Bludit CMS through 3.22.0 contains a missing authorization vulnerability that allows authenticated users holding the Author or Editor role to read the full content of private drafts and scheduled posts belonging to any other user, including administrators, by exploiting the content-get-list AJAX endpoint in bl-kernel/ajax/content-get-list.php. Attackers can send an authenticated GET request to the admin AJAX endpoint with the draft parameter set to true, triggering getList() without ownership constraints and returning serialized page objects site-wide, exposing pre-publication material and sensitive notes stored in administrator-owned drafts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-28

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-93365

EUVD

EUVD-2026-87209

Affected Vendors & Products

Vendor	Product	Version / Range
bludit	bludit	3.22.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Bludit CMS versions up to 3.22.0 have a missing authorization flaw. Authenticated users with Author or Editor roles can access private drafts and scheduled posts of any other user, including administrators, by sending a crafted GET request to the admin AJAX endpoint. This exposes unpublished content and sensitive notes.

Detection Guidance

To detect this vulnerability, check for unauthorized access to private drafts or scheduled posts via the Bludit CMS admin AJAX endpoint. Monitor HTTP GET requests to admin/ajax/content-get-list.php with the draft parameter set to true. Review server logs for unusual activity from authenticated users with Author or Editor roles accessing content they do not own.

Impact Analysis

If you use Bludit CMS with Author or Editor roles, attackers with those roles could steal unpublished content, including sensitive drafts or notes from administrators. This could lead to data leaks before content is intended for public release.

Compliance Impact

This vulnerability could violate GDPR or HIPAA by exposing private or sensitive data before it is officially published. Unauthorized access to drafts or notes may result in non-compliance with data protection requirements.

Mitigation Strategies

Immediately update Bludit CMS to the latest version beyond 3.22.0. Restrict access to the admin AJAX endpoint by implementing proper authorization checks. Review user roles and permissions to ensure only necessary access is granted. Monitor for suspicious activity and audit draft content access logs.

Hi! I’m here to help you understand CVE-2026-93365. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70