Bludit CMS versions up to 3.22.0 contain a missing authorization flaw that allows authenticated users with Author or Editor roles to bypass ownership checks on the content‑get‑list AJAX endpoint, causing the application to return serialized page objects for all private drafts and scheduled posts. This results in the disclosure of pre‑publication content and sensitive notes kept in administrator‑owned drafts, a direct violation of confidentiality as described by CWE‑862.

The vulnerability affects all Bludit CMS installations running version 3.22.0 or earlier. Any copy of the CMS that has not been upgraded beyond this release is susceptible and capable of leaking private content to other authenticated users.

The CVSS base score of 7.1 indicates a high severity risk for data exposure when an attacker controls an Author or Editor account. The EPSS score is not available and the vulnerability is not listed in CISA KEV, suggesting limited documented exploitation. However, the attack only requires an authenticated session and a simple GET request to bl‑kernel/ajax/content-get-list.php with the draft parameter set to true, making the exploit straightforward once legitimate credentials are compromised. The lack of additional authentication barriers means that insiders or compromised accounts pose the greatest threat to sensitive content.