CVE-2026-46656highCWE-285CWE-613

CVE-2026-46656: high-severity vulnerability in bludit

Bludit CMS has improper authorization and mediation failure leading to persistent ghost sessions

Published

Follow this CVE+ Monitor Bludit

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 0.3%
Bludit is a content management system. Versions prior to 3.22.0 have a Broken Access Control flaw where active sessions remain valid even after the corresponding user account has been physically deleted from the database. This "Ghost Session" allows revoked users to maintain full unauthorized access to the system. Version 3.22.0 fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
bludit · bludit
Related CVEs — bludit

In the same product, most dangerous first.

CVE-2026-41456MEDIUMBludit CMS Reflected XSS via Search PluginEPSS 3.5%CVE-2026-46657HIGHBludit's persistent authentication tokens not revoked upon account disablementEPSS 0.3%