CVE-2026-93365: Bludit CMS 3.22.0 Missing Authorization via content-get-list AJAX Endpoint
Bludit CMS through 3.22.0 contains a missing authorization vulnerability that allows authenticated users holding the Author or Editor role to read the full content of private drafts and scheduled posts belonging to any other user, including administrators, by exploiting the content-get-list AJAX endpoint in bl-kernel/ajax/content-get-list.php. Attackers can send an authenticated GET request to the admin AJAX endpoint with the draft parameter set to true, triggering getList() without ownership constraints and returning serialized page objects site-wide, exposing pre-publication material and sensitive notes stored in administrator-owned drafts.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated user with the Author or Editor role can exploit the affected AJAX endpoint. Administrator privileges are not required.
What information can be exposed?
The issue can disclose the full content of private drafts and scheduled posts owned by other users, including administrators. This may include pre-publication material and sensitive notes stored in administrator-owned drafts.
What request behavior triggers the exposure?
An authorized Author or Editor can send an authenticated GET request to the administrative content-get-list AJAX endpoint with the draft parameter set to true. The endpoint returns page objects without enforcing ownership restrictions.
Are public or anonymous visitors affected?
The provided information indicates that exploitation requires authentication and an Author or Editor role. It does not indicate that unauthenticated visitors can access the exposed draft content.