CVE-2026-93364 in Bludit
Summary
by MITRE • 09/25/2026
Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows authenticated users with the Author role to modify privileged page fields reserved for administrators by injecting reserved parameters into a content save request. Attackers can submit reserved fields such as type and username through the Pages::edit() function in bl-kernel/pages.class.php, which iterates all fields declared in dbFields without per-field authorization, enabling an Author to convert pages to static site-wide navigation entries or transfer page ownership to arbitrary accounts.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified in Bludit CMS versions through 3.22.0 represents a critical mass assignment flaw within the content management system's core architecture. This security defect specifically targets authenticated users who possess the Author role, allowing them to escalate their privileges by manipulating reserved page fields that are strictly intended for administrative control. The root cause lies in the implementation of the Pages::edit() function located in the bl-kernel/pages.class.php file. During the process of saving content updates, this function iterates through all fields declared in the dbFields array without performing granular authorization checks on a per-field basis. Consequently, any field present in that list can be overwritten by an authenticated user if they include it in their HTTP request payload, regardless of whether that specific field is supposed to be editable by users with lower privilege levels such as Authors or Contributors.
From a technical perspective, the absence of strict property filtering allows attackers to inject reserved parameters directly into content save requests. By manipulating fields such as type and username, an attacker can fundamentally alter the nature of existing pages within the CMS. For instance, changing the page type parameter enables the conversion of standard dynamic pages into static site-wide navigation entries, which are typically managed exclusively by administrators to maintain consistent website structure. Furthermore, modifying the username field allows for the transfer of page ownership from its original creator or administrator to an arbitrary account controlled by the attacker. This capability effectively bypasses the intended role-based access control mechanisms, as the system fails to validate whether the authenticated user has sufficient permissions to modify these specific high-privilege attributes before applying them to the database.
The operational impact of this vulnerability is significant, as it compromises both the integrity and availability of the content management system. An attacker with Author-level credentials can disrupt site navigation by altering page types, potentially breaking layout consistency or causing functional errors across the website. More critically, the ability to transfer ownership of pages allows for persistent unauthorized control over critical content areas. This could lead to defacement, insertion of malicious scripts via admin-controlled templates, or complete takeover of specific sections of the application that were previously restricted from lower-level users. The vulnerability essentially undermines the principle of least privilege by allowing a standard user to perform actions reserved for system administrators, thereby eroding trust in the authentication and authorization layers of Bludit CMS.
To mitigate this risk, immediate updates to version 3.22.1 or later are strongly recommended, as these versions include patches that enforce proper field-level validation during content editing operations. In environments where upgrading is not immediately feasible, administrators should implement strict input filtering at the application layer to whitelist only those fields explicitly permitted for Author-role modifications before they reach the database update logic. Additionally, enabling comprehensive audit logging can help detect anomalous patterns of page edits involving reserved fields such as type or username changes initiated by non-administrative accounts. Regular security assessments and code reviews focusing on mass assignment vulnerabilities are essential to prevent similar issues in future development cycles. This incident highlights the importance of implementing robust authorization checks that validate user permissions against specific data attributes rather than relying solely on general role-based access controls during write operations.
This vulnerability aligns with CWE-284, which describes Improper Access Control, specifically regarding insufficient validation of input parameters leading to privilege escalation. It also maps to MITRE ATT&CK technique T1078, Valid Accounts, as the exploitation requires legitimate authentication credentials but abuses them to gain unauthorized administrative capabilities through mass assignment manipulation. Understanding these mappings helps security teams prioritize remediation efforts and align their defensive strategies with established industry standards for preventing access control bypasses in web applications.