CVE-2026-93364: Bludit CMS 3.22.0 Mass Assignment Privilege Escalation via Pages::edit()
Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows authenticated users with the Author role to modify privileged page fields reserved for administrators by injecting reserved parameters into a content save request. Attackers can submit reserved fields such as type and username through the Pages::edit() function in bl-kernel/pages.class.php, which iterates all fields declared in dbFields without per-field authorization, enabling an Author to convert pages to static site-wide navigation entries or transfer page ownership to arbitrary accounts.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with the Author role can exploit it. The attacker must be able to submit a content save request that reaches Pages::edit().
What unauthorized changes can an affected Author make?
An Author can inject reserved fields including type and username. This can convert a page into a static site-wide navigation entry or transfer ownership of a page to an arbitrary account.
How can administrators determine whether their installation is affected?
The issue affects Bludit CMS through version 3.22.0. Review content-save requests from Author accounts for reserved parameters such as type or username, and check for unexpected page-type changes or ownership transfers.