EUVD-2026-35081Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionGitHub Advisory
Bludit is a content management system. Versions prior to 3.22.0 have a Broken Access Control flaw where active sessions remain valid even after the corresponding user account has been physically deleted from the database. This "Ghost Session" allows revoked users to maintain full unauthorized access to the system. Version 3.22.0 fixes the issue.
AnalysisAI
Broken access control in Bludit CMS versions prior to 3.22.0 allows deleted user accounts to retain full authenticated access through pre-existing 'Ghost Sessions' that are never invalidated upon account removal. An authenticated attacker whose account is subsequently revoked can continue performing privileged operations until the session naturally expires. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to have previously held a valid Bludit user account (any role) and to have an active authenticated session at the moment the administrator deletes that account; the original session cookie or tokenAuth must remain in the attacker's possession. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields 8.8 (High) and accurately reflects the scenario: a low-privileged authenticated user with an active session retains high-impact access after revocation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A contractor is granted an Editor account on a Bludit site and logs in, establishing an authenticated browser session. The site administrator later deletes the contractor's account at the end of the engagement, but the contractor continues using the still-valid session cookie to publish, modify, or delete content - and depending on their original role, potentially escalate or alter site configuration - until the session naturally expires. |
| Remediation | Vendor-released patch: upgrade to Bludit 3.22.0 or later, available at https://github.com/bludit/bludit/releases/tag/3.22.0; the underlying fix is commit 7931d1c55a3cc535911a9901c328f0197afe1c9f. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Identify all Bludit CMS deployments, document versions, active users, and current sessions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today