CVE-2026-46656

Bludit CMS has improper authorization and mediation failure leading to persistent ghost sessions

State: Published
Severity: 8.8 High
Published: Jun 8, 2026
Updated: Jun 8, 2026
Reserved: May 15, 2026

Description

Bludit is a content management system. Versions prior to 3.22.0 have a Broken Access Control flaw where active sessions remain valid even after the corresponding user account has been physically deleted from the database. This "Ghost Session" allows revoked users to maintain full unauthorized access to the system. Version 3.22.0 fixes the issue.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-285 Improper Authorization
CWE-613 Insufficient Session Expiration

Affected Products

Product	Versions
bluditbludit	< 3.22.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.