Bludit CMS releases up to 3.22.0 contain an authorization bypass flaw that lets an authenticated user with the Author role enumerate and delete media files on pages owned by other users. By supplying arbitrary page UUIDs to unprotected AJAX endpoints, the attacker can retrieve a list of all user page UUIDs through the content‑get‑list endpoint and then craft POST requests to the list‑images and delete‑image endpoints in bl‑kernel/ajax/. This enables the abuse of the IMAGE_RESTRICT isolation control and results in loss of content and site integrity.

Bludit CMS, version 3.22.0 and earlier are affected. All installations running this version without a later patch or update are vulnerable.

The CVSS score of 5.3 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in CISA KEV. The attacker only needs to be a legitimate user with the Author role, which is a common permission level on many sites, making exploitation likely if the attacker gains any authenticated status. The lack of network or remote privilege escalation limits the scope; however, the ability to delete media owned by administrators may produce reputational or operational damage.