Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-46656: Bludit CMS lets deleted users stay logged in

CVE-2026-46656 · published 4 months ago

Summary

If you run Bludit CMS versions before 3.22.0, a user whose account is removed from the database can still keep using an existing login session. This means a former employee or contractor could continue accessing the site with full rights. Update to version 3.22.0 as soon as possible to close the gap.

Original advisory text

Bludit CMS has improper authorization and mediation failure leading to persistent ghost sessions

Bludit is a content management system. Versions prior to 3.22.0 have a Broken Access Control flaw where active sessions remain valid even after the corresponding user account has been physically deleted from the database. This "Ghost Session" allows revoked users to maintain full unauthorized access to the system. Version 3.22.0 fixes the issue.

References

https://github.com/bludit/bludit/releases/tag/3.22.0 URL
https://github.com/bludit/bludit/security/advisories/GHSA-rpq2-j9w3-h4jw Vendor Advisory
https://github.com/bludit/bludit/commit/7931d1c55a3cc535911a9901c328f0197afe1c9f Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46656... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-46656 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-285Improper Authorization

CWE-613Insufficient Session Expiration

Timeline

Published8 Jun 2026

Updated3 Nov 2026

First seen8 Jun 2026

Sources

CVE-2026-46656 · NVD

CVE-2026-46656 · OSV

GHSA-rpq2-j9w3-h4jw · GHSA

Track software like this

Free during beta