CVE-2026-93366 Details

An authorization bypass vulnerability has been identified in Bludit CMS versions through 3.22.0. This vulnerability allows authenticated users with the Author role to enumerate and delete media files from pages owned by other users, including administrators. The issue arises from unprotected AJAX endpoints that accept arbitrary UUID parameters. Attackers can exploit this by first retrieving page UUIDs for all users through the content-get-list endpoint, and then sending crafted POST requests to the list-images and delete-image endpoints in bl-kernel/ajax/. This exploitation bypasses the IMAGE_RESTRICT isolation control, enabling unauthorized access to media files on pages not owned by the user.