The vulnerability in Bludit CMS 3.22.0 allows an authenticated user with the Author role to perform a mass assignment through the Pages::edit() method. By sending reserved parameters such as type and username in a content save request, the author can alter page fields that are meant for administrative use. This vulnerability is a mass assignment flaw (CWE-915) that grants the attacker the ability to change a page to a static navigation entry accessible site‑wide or to transfer page ownership to an arbitrary user account.

Affected systems include Bludit CMS installations running version 3.22.0 or earlier that have not applied the fix. The issue exists in bl-kernel/pages.class.php where the code iterates over all fields defined in dbFields without checking per‑field authorization. Any Bludit CMS deployment that allows the Author role to access Pages::edit() is vulnerable.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score is not available, so the exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV. Attackers need only authenticated access with Author privileges, making it a privileged local attack that could elevate their authority and potentially gain administrative capabilities by manipulating page metadata. No public exploit has been recorded, but the clear path for abuse makes mitigation prudent.