{"id":"CVE-2026-93364","title":"Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows authenticated users with the Author role to modify privileged page fields reserved for administrators by injecting reserved parameters into a content save req…","summary":"Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows authenticated users with the Author role to modify privileged page fields reserved for administrators by injecting reserved parameters into a content save req…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cwe":["CWE-915","CWE-862"],"vendor":"Bludit","product":"Bludit CMS","affected":["cms <= 3.22.0","cms <= 4.0.0-beta-1","cms <= 074773eff34b91c002ab9d99029a3edca4934bf1"],"published":"2026-09-25","updated":"2026-09-25","sourceUpdated":"2026-09-25T18:17:33.313","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93364","references":[{"url":"https://gist.github.com/akinerkisa/6a7532442795beefd29b9c55a100eb16","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/bludit-cms-mass-assignment-privilege-escalation-via-pages-edit","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-25T17:42:49.466454Z"},"ingestedAt":"2026-09-25T17:13:14.013Z","slug":"CVE-2026-93364","body":"## Overview\n\nBludit CMS through 3.22.0 contains a mass assignment vulnerability that allows authenticated users with the Author role to modify privileged page fields reserved for administrators by injecting reserved parameters into a content save request. Attackers can submit reserved fields such as type and username through the Pages::edit() function in bl-kernel/pages.class.php, which iterates all fields declared in dbFields without per-field authorization, enabling an Author to convert pages to static site-wide navigation entries or transfer page ownership to arbitrary accounts.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}