CVE-2026-27741

Bludit version 3.16.1 contains a cross-site request forgery (CSRF) vulnerability in the /admin/uninstall-plugin/ and /admin/install-theme/ endpoints. The application does not implement anti-CSRF tokens or other request origin validation mechanisms for these administrative actions. An attacker can induce an authenticated administrator to visit a malicious page that silently submits crafted requests, resulting in unauthorized plugin uninstallation or theme installation. This may lead to loss of functionality, execution of untrusted code via malicious themes, and compromise of system integrity.

• CWE-352

• https://github.com/bludit/bludit/issues/1577Exploit, Issue Tracking
• https://www.vulncheck.com/advisories/bludit-csrf-in-plugin-and-theme-management-endpointsThird Party Advisory

Published

Feb 23, 2026

Last Modified

Jul 14, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27736BigBlueButton is an open-source virtual classroom. In versio…6.1
• CVE-2026-27737BigBlueButton is an open-source virtual classroom. In versio…6.5
• CVE-2026-27738The Angular SSR is a server-rise rendering tool for Angular …6.9
• CVE-2026-27739The Angular SSR is a server-rise rendering tool for Angular …9.2
• CVE-2026-2774Integer overflow in the Audio/Video component. This vulnerab…9.8
• CVE-2026-27740Discourse is an open-source discussion platform. Versions pr…6.1
• CVE-2026-27742Bludit version 3.16.2 contains a stored cross-site scripting…5.4
• CVE-2026-27743The SPIP referer_spam plugin versions prior to 1.3.0 contain…9.8
• CVE-2026-27744The SPIP tickets plugin versions prior to 4.3.3 contain an u…9.8
• CVE-2026-27745The SPIP interface_traduction_objets plugin versions prior t…8.8
• CVE-2026-27746The SPIP jeux plugin versions prior to 4.1.1 contain a refle…6.1
• CVE-2026-27747The SPIP interface_traduction_objets plugin versions prior t…8.8