CVE-2026-93364 Bludit CMS 3.22.0 Mass Assignment Privilege Escalation via Pages::edit()
Authenticated Authors can escalate privileges and modify page ownership by injecting reserved parameters into the Pages::edit() function.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-93364?
CVE-2026-93364 is a medium-severity vulnerability in Bludit CMS, published on 25 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows authenticated users with the Author role to modify privileged page fields reserved for administrators by injecting reserved parameters into a content save request. Attackers can submit reserved fields such as type and username through the Pages::edit() function in bl-kernel/pages.class.php, which iterates all fields declared in dbFields without per-field authorization, enabling an Author to convert pages to static site-wide navigation entries or transfer page ownership to arbitrary accounts.
Weakness: CWE-915
Which versions are affected by CVE-2026-93364?
How do I fix CVE-2026-93364?
No fix has been published for CVE-2026-93364 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-93364 being exploited?
There is no known exploitation of CVE-2026-93364 in the wild and no public exploit code.
Sources
Also known as GHSA-2997-gxgc-mq2w.