Is CVE-2026-93365 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93365 being exploited in the wild.

How severe is CVE-2026-93365?

Medium severity, with a CVSS score of 6.5, published 25 September 2026.

Which products and versions are affected?

Bludit CMS through 3.22.0; also 4.0.0-beta-1.

Is there a fix for CVE-2026-93365?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-93365 attacked?

It is attacked over the network.

Am I affected by CVE-2026-93365?

Check whether you run Bludit CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93365: Bludit CMS missing authorization in AJAX endpoint

CVE-2026-93365 · Severity: medium · CVSS 6.5 · Published 2026-09-25

Bludit CMS is a content management system used to publish web content and manage drafts. Authenticated users with Author or Editor roles can read private drafts and scheduled posts belonging to other users, including administrators, by exploiting an AJAX endpoint that lacks proper authorization checks. This allows attackers to view unpublished material and sensitive administrator notes before they are intended for publication.

Technologies: Bludit CMS. Vendors: Bludit.

Quick answers

Is CVE-2026-93365 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93365 being exploited in the wild.
How severe is CVE-2026-93365?: Medium severity, with a CVSS score of 6.5, published 25 September 2026.
Which products and versions are affected?: Bludit CMS through 3.22.0; also 4.0.0-beta-1.
Is there a fix for CVE-2026-93365?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-93365 attacked?: It is attacked over the network.
Am I affected by CVE-2026-93365?: Check whether you run Bludit CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The content-get-list AJAX endpoint in bl-kernel/ajax/content-get-list.php fails to enforce ownership constraints when the draft parameter is set to true, causing getList() to return serialized page objects without verifying user permissions. An authenticated GET request with Author or Editor role can trigger the vulnerability over the network. The fix requires adding field-level authorization checks to prevent unprivileged users from accessing drafts and scheduled content outside their ownership scope.

Affected products

Bludit CMS through 3.22.0; also 4.0.0-beta-1

Timeline

2026-09-25: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.