CVE-2026-93364 Details

A mass assignment vulnerability has been identified in Bludit CMS versions through 3.22.0. This vulnerability allows authenticated users with the Author role to manipulate privileged page fields that are typically reserved for administrators. By injecting reserved parameters into a content save request, Authors can alter important page attributes. The issue arises in the Pages::edit() function within bl-kernel/pages.class.php, where all fields declared in dbFields are processed without proper authorization for each field. This oversight enables Authors to change pages into static site-wide navigation entries or transfer page ownership to other accounts.