CVE-2026-46656

Published: Jun 8, 2026Modified: Jul 23, 2026Deferred

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: security-advisories@github.com (Secondary)

Description

Bludit is a content management system. Versions prior to 3.22.0 have a Broken Access Control flaw where active sessions remain valid even after the corresponding user account has been physically deleted from the database. This "Ghost Session" allows revoked users to maintain full unauthorized access to the system. Version 3.22.0 fixes the issue.

Related CWEs

Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (4)

https://github.com/bludit/bludit/commit/7931d1c55a3cc535911a9901c328f0197afe1c9f

Source: security-advisories@github.com

https://github.com/bludit/bludit/releases/tag/3.22.0

Source: security-advisories@github.com

https://github.com/bludit/bludit/security/advisories/GHSA-rpq2-j9w3-h4jw

Source: security-advisories@github.com

https://github.com/bludit/bludit/security/advisories/GHSA-rpq2-j9w3-h4jw

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.