Vulnerability · Published Jun 8, 2026 · Assigned by GitHub_M
CVE-2026-46656Bludit CMS has improper authorization and mediation failure leading to persistent ghost sessions
High 8.8
In plain English
A high-severity security flaw in bludit from bludit. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.3%top 77.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Bludit is a content management system. Versions prior to 3.22.0 have a Broken Access Control flaw where active sessions remain valid even after the corresponding user account has been physically deleted from the database. This "Ghost Session" allows revoked users to maintain full unauthorized access to the system. Version 3.22.0 fixes the issue.
Affected products (as reported)
Weakness: CWE-285, CWE-613 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/bludit/bludit/security/advisories/GHSA-rpq2-j9w3-h4jw x_refsource_CONFIRM
- https://github.com/bludit/bludit/commit/7931d1c55a3cc535911a9901c328f0197afe1c9f x_refsource_MISC
- https://github.com/bludit/bludit/releases/tag/3.22.0 x_refsource_MISC