CVE-2026-93366: Bludit CMS 3.22.0 Authorization Bypass via list-images/delete-image AJAX Endpoints
Bludit CMS through 3.22.0 contains an authorization bypass vulnerability that allows authenticated users with the Author role to enumerate and delete media files belonging to pages owned by other users, including administrators, by supplying arbitrary uuid parameters to unprotected AJAX endpoints. Attackers can retrieve page UUIDs for all users via the content-get-list endpoint and then submit crafted POST requests to the list-images and delete-image endpoints in bl-kernel/ajax/ to access and destroy media files outside their own pages, bypassing the IMAGERESTRICT isolation control.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated user with the Author role can exploit the affected AJAX endpoints. No administrator privileges or user interaction are required.
What resources can an attacker access or delete?
An Author can enumerate and delete media files associated with pages owned by other users, including administrators. The issue bypasses the IMAGE_RESTRICT isolation control intended to limit access to a user’s own page media.
How does exploitation work?
The attacker can obtain page UUIDs for users’ pages through the content-get-list endpoint, then provide arbitrary UUID values in POST requests to the list-images and delete-image endpoints under bl-kernel/ajax/. Affected releases include Bludit CMS through 3.22.0.