What is the CVSS score of CVE-2026-46656?

CVE-2026-46656 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Bludit are affected by CVE-2026-46656?

Bludit CMS versions prior to 3.22.0 contain a broken access control vulnerability allowing deleted user accounts to maintain authenticated system access through persistent sessions.. A patch is available.

How to fix or mitigate CVE-2026-46656?

24 hours: Identify all Bludit CMS deployments, document versions, active users, and current sessions. 7 days: Implement emergency mitigations-enforce automatic session invalidation upon account deletion, limit session lifespans to maximum 24 hours, and enable IP address pinning. 30 days: Monitor Bludit project communications for patch release; prepare upgrade plan for all affected instances.

Bludit CVE-2026-46656

EUVD-2026-35081 HIGH

Improper Authorization (CWE-285)

2026-06-08 GitHub_M

Authentication Bypass Bludit

8.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 08, 2026 - 17:01 EUVD

Source Code Evidence Fetched

Jun 08, 2026 - 16:16 vuln.today

Analysis Generated

Jun 08, 2026 - 16:16 vuln.today

DescriptionCVE.org

Bludit is a content management system. Versions prior to 3.22.0 have a Broken Access Control flaw where active sessions remain valid even after the corresponding user account has been physically deleted from the database. This "Ghost Session" allows revoked users to maintain full unauthorized access to the system. Version 3.22.0 fixes the issue.

AnalysisAI

Broken access control in Bludit CMS versions prior to 3.22.0 allows deleted user accounts to retain full authenticated access through pre-existing 'Ghost Sessions' that are never invalidated upon account removal. An authenticated attacker whose account is subsequently revoked can continue performing privileged operations until the session naturally expires. No public exploit identified at time of analysis, though the fix commit on GitHub publicly discloses the exact root cause.

Technical ContextAI

Bludit is a flat-file PHP-based content management system that stores user data in JSON files rather than a traditional database. The vulnerability falls under CWE-285 (Improper Authorization) and stems from the isLogged() method in bl-kernel/login.class.php, which previously validated only the session token without verifying that the underlying user record still existed. The patched code adds a lookup via getUserDB() and explicitly destroys the session if the user record is missing or the password field is set to '!' (the disabled-account sentinel). A complementary change in users.class.php rotates tokenAuth and clears tokenRemember on user state changes, ensuring residual authentication tokens cannot be replayed.

RemediationAI

Vendor-released patch: upgrade to Bludit 3.22.0 or later, available at https://github.com/bludit/bludit/releases/tag/3.22.0; the underlying fix is commit 7931d1c55a3cc535911a9901c328f0197afe1c9f. As an interim compensating control when administrators delete a user, manually purge all active sessions by clearing the bl-content/databases/security.php or equivalent session store and forcing reauthentication of all users - this logs everyone out, including legitimate users, which is the trade-off. Additionally, restricting the Bludit admin panel to a VPN or trusted IP range reduces the attack surface for any lingering session, at the cost of remote administrative convenience. Refer to the security advisory at https://github.com/bludit/bludit/security/advisories/GHSA-rpq2-j9w3-h4jw for full vendor guidance.