Vulnerability Description
Bludit is a content management system. Versions prior to 3.22.0 have a Broken Access Control flaw where active sessions remain valid even after the corresponding user account has been physically deleted from the database. This "Ghost Session" allows revoked users to maintain full unauthorized access to the system. Version 3.22.0 fixes the issue.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/bludit/bludit/commit/7931d1c55a3cc535911a9901c328f0197afe1c9f
- https://github.com/bludit/bludit/releases/tag/3.22.0
- https://github.com/bludit/bludit/security/advisories/GHSA-rpq2-j9w3-h4jw
- https://github.com/bludit/bludit/security/advisories/GHSA-rpq2-j9w3-h4jw
FAQ
What is CVE-2026-46656?
CVE-2026-46656 is a vulnerability with a CVSS score of 8.8 (HIGH). Bludit is a content management system. Versions prior to 3.22.0 have a Broken Access Control flaw where active sessions remain valid even after the corresponding user account has been physically dele...
How severe is CVE-2026-46656?
CVE-2026-46656 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-46656?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.