CVE-2026-93365 in Bludit
Summary
by MITRE • 09/25/2026
Bludit CMS through 3.22.0 contains a missing authorization vulnerability that allows authenticated users holding the Author or Editor role to read the full content of private drafts and scheduled posts belonging to any other user, including administrators, by exploiting the content-get-list AJAX endpoint in bl-kernel/ajax/content-get-list.php. Attackers can send an authenticated GET request to the admin AJAX endpoint with the draft parameter set to true, triggering getList() without ownership constraints and returning serialized page objects site-wide, exposing pre-publication material and sensitive notes stored in administrator-owned drafts.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified in Bludit CMS versions up through 3.22.0 represents a critical failure in access control mechanisms within the application's administrative interface. Specifically, this flaw resides in the AJAX endpoint located at bl-kernel/ajax/content-get-list.php, which is designed to retrieve lists of content items for display in the backend dashboard. The core technical deficiency lies in the implementation of the getList() function associated with this endpoint. While the system correctly enforces role-based access control for many operations, it fails to validate ownership constraints when retrieving draft or scheduled posts. This means that once an attacker has successfully authenticated into the application and holds a privileged role such as Author or Editor, they can bypass logical checks intended to restrict visibility of content owned by other users. The vulnerability is not related to authentication failure but rather to authorization logic errors where the server trusts client-supplied parameters without verifying if the requesting user has legitimate rights to access the specific resources being requested.
From a technical perspective, an attacker exploits this flaw by sending a crafted GET request to the admin AJAX endpoint with the draft parameter explicitly set to true. Under normal circumstances, such a query should return only drafts created by the authenticated user or those shared appropriately within their permission scope. However, due to the missing authorization check, the backend processes this request without filtering results based on ownership. Consequently, the server returns serialized page objects for all private drafts and scheduled posts across the entire site, regardless of who authored them. This includes sensitive materials belonging to administrators, such as pre-publication articles, internal notes, or strategic content that has not yet been made public. The serialization format allows the attacker to parse structured data containing titles, metadata, and full body text, effectively turning a standard administrative feature into an information disclosure vector.
The operational impact of this vulnerability is significant for organizations relying on Bludit CMS for managing sensitive editorial workflows. Administrators often use private drafts to store confidential business strategies, unpublished marketing materials, or internal communications that are not intended for public consumption. The exposure of these documents can lead to competitive intelligence leaks, reputational damage, and potential regulatory non-compliance if personal data or proprietary information is inadvertently disclosed. Furthermore, the ability to view scheduled posts allows attackers to anticipate future content releases, which could facilitate targeted social engineering attacks against users who interact with that content or allow for more precise timing of further exploits based on known site updates. The breadth of access extends beyond just reading text; it provides a comprehensive map of the organization's editorial pipeline and internal communications structure.
This vulnerability aligns closely with CWE-284, which describes Improper Access Control, specifically highlighting failures in enforcing restrictions on what authenticated users are allowed to do. It also maps to MITRE ATT&CK technique T1005, Data from Local System Retrieval, as the attacker is extracting sensitive data directly from the application's storage mechanisms via an authorized but misconfigured interface. To mitigate this risk, immediate action should be taken by upgrading Bludit CMS to a version later than 3.22.0 where these authorization checks have been corrected. In environments where patching is not immediately feasible, administrators can implement web application firewall rules to restrict access to the content-get-list.php endpoint or monitor for anomalous GET requests with draft parameters set to true originating from non-administrator accounts. Additionally, reviewing server logs for unusual patterns of data retrieval by lower-privileged users can help detect ongoing exploitation attempts before significant damage occurs.