---
id: CVE-2026-93366
title: >-
  Bludit CMS through 3.22.0 contains an authorization bypass vulnerability that
  allows authenticated users with the Author role to enumerate and delete media
  files belonging to pages owned by other users, including administrators, by
  suppl…
summary: >-
  Bludit CMS through 3.22.0 contains an authorization bypass vulnerability that
  allows authenticated users with the Author role to enumerate and delete media
  files belonging to pages owned by other users, including administrators, by
  suppl…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-639
vendor: Bludit
product: Bludit CMS
affected:
  - cms <= 3.22.0
  - cms <= 4.0.0-beta-1
  - cms <= 074773eff34b91c002ab9d99029a3edca4934bf1
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T18:17:33.583'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93366'
references:
  - url: 'https://gist.github.com/akinerkisa/6a7532442795beefd29b9c55a100eb16'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/bludit-cms-authorization-bypass-via-list-images-delete-image-ajax-endpoints
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-25T18:14:20.467Z'
---

## Overview

Bludit CMS through 3.22.0 contains an authorization bypass vulnerability that allows authenticated users with the Author role to enumerate and delete media files belonging to pages owned by other users, including administrators, by supplying arbitrary uuid parameters to unprotected AJAX endpoints. Attackers can retrieve page UUIDs for all users via the content-get-list endpoint and then submit crafted POST requests to the list-images and delete-image endpoints in bl-kernel/ajax/ to access and destroy media files outside their own pages, bypassing the IMAGE_RESTRICT isolation control.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.