---
id: CVE-2026-93364
title: >-
  Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows
  authenticated users with the Author role to modify privileged page fields
  reserved for administrators by injecting reserved parameters into a content
  save req…
summary: >-
  Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows
  authenticated users with the Author role to modify privileged page fields
  reserved for administrators by injecting reserved parameters into a content
  save req…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-915
  - CWE-862
vendor: Bludit
product: Bludit CMS
affected:
  - cms <= 3.22.0
  - cms <= 4.0.0-beta-1
  - cms <= 074773eff34b91c002ab9d99029a3edca4934bf1
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T18:17:33.313'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93364'
references:
  - url: 'https://gist.github.com/akinerkisa/6a7532442795beefd29b9c55a100eb16'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/bludit-cms-mass-assignment-privilege-escalation-via-pages-edit
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-25T17:42:49.466454Z'
ingestedAt: '2026-09-25T17:13:14.013Z'
---

## Overview

Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows authenticated users with the Author role to modify privileged page fields reserved for administrators by injecting reserved parameters into a content save request. Attackers can submit reserved fields such as type and username through the Pages::edit() function in bl-kernel/pages.class.php, which iterates all fields declared in dbFields without per-field authorization, enabling an Author to convert pages to static site-wide navigation entries or transfer page ownership to arbitrary accounts.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.