What is the CVSS score of CVE-2026-46657?

CVE-2026-46657 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Bludit are affected by CVE-2026-46657?

Bludit CMS versions prior to 3.22.0 contain an authentication bypass that allows deactivated user accounts to retain full system access through persistent 'Remember Me' cookies, effectively…. A patch is available.

How to fix or mitigate CVE-2026-46657?

Within 24 hours: Inventory all Bludit CMS instances and their versions; identify and document all deactivated user accounts. Within 7 days: Force site-wide logout and mandate password reset for all active accounts; audit authentication logs for any activity from deactivated accounts; remove tokenAuth and tokenRemember database entries for all deactivated users. Within 30 days: Upgrade all instances to Bludit 3.22.0 or later; implement automated token invalidation on account deactivation if using older versions; document remediation in access control policy.

Bludit CVE-2026-46657

EUVD-2026-35085 HIGH

Improper Removal of Sensitive Information Before Storage or Transfer (CWE-212)

2026-06-08 GitHub_M

Authentication Bypass Bludit

7.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jun 08, 2026 - 17:01 EUVD

Source Code Evidence Fetched

Jun 08, 2026 - 16:17 vuln.today

Analysis Generated

Jun 08, 2026 - 16:17 vuln.today

DescriptionCVE.org

Bludit is a content management system. Versions prior to 3.22.0 have a vulnerability in the user management logic that allows deactivated accounts to maintain access via persistent authentication tokens. When an administrator disables a user account, the application fails to invalidate or clear the associated tokenAuth and tokenRemember fields in the JSON database. Consequently, any user with a pre-existing "Remember Me" cookie can bypass the account disablement and maintain a valid authenticated state. Version 3.22.0 patches the issue.

AnalysisAI

Authentication bypass in Bludit CMS versions prior to 3.22.0 allows deactivated user accounts to retain authenticated access through persistent 'Remember Me' cookies, because the disable-account workflow fails to invalidate tokenAuth and tokenRemember values stored in the JSON database. Any user who previously logged in with the persistent session option can continue to act with their original privileges even after an administrator disables them. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Bludit is a flat-file PHP content management system that persists user records, including session tokens, in a JSON database rather than a traditional RDBMS. The vulnerability is rooted in CWE-212 (Improper Removal of Sensitive Information Before Storage or Transfer): when the administrative 'disable user' operation updates the user record, it leaves the tokenAuth (API/session token) and tokenRemember (long-lived cookie token) fields intact. Because Bludit's authentication middleware accepts a valid tokenRemember cookie to reconstitute a session without re-checking the account's enabled flag, the disabled state is never enforced for already-issued persistent sessions. The CPE cpe:2.3:a:bludit:bludit:*:*:*:*:*:*:*:* covers all Bludit versions up to but not including 3.22.0.

RemediationAI

Vendor-released patch: Bludit 3.22.0, which adds session invalidation for disabled users per release note 'Fix: Invalidate sessions for disabled users (GHSA-q42h-wpg8-5wwf)'; upgrade via https://github.com/bludit/bludit/releases/tag/3.22.0 and consult the advisory at https://github.com/bludit/bludit/security/advisories/GHSA-ggqg-xvx6-hgwh. After upgrading, force a global session reset by rotating or clearing the tokenAuth and tokenRemember fields for every user in bl-content/databases/users.php so any tokens issued before the patch can no longer authenticate. If immediate upgrade is not possible, the most direct compensating control is to delete (rather than merely disable) accounts that must lose access, accepting the side effect of losing that user's authorship history; alternatively, manually edit the JSON user database to blank out tokenAuth and tokenRemember whenever an account is disabled, and instruct users to uncheck Remember Me at login until the patch is applied.