CVE-2026-46657highCWE-212CWE-613

CVE-2026-46657: falha de alta gravidade em bludit

Bludit's persistent authentication tokens not revoked upon account disablement

Publicada em

Seguir esta CVE+ Monitorar Bludit

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 0.3%
Bludit is a content management system. Versions prior to 3.22.0 have a vulnerability in the user management logic that allows deactivated accounts to maintain access via persistent authentication tokens. When an administrator disables a user account, the application fails to invalidate or clear the associated tokenAuth and tokenRemember fields in the JSON database. Consequently, any user with a pre-existing "Remember Me" cookie can bypass the account disablement and maintain a valid authenticated state. Version 3.22.0 patches the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Produtos afetados
bludit · bludit
CVEs relacionadas — bludit

No mesmo produto, das mais perigosas para as menos.

CVE-2026-41456MEDIUMBludit CMS Reflected XSS via Search PluginEPSS 3.5%CVE-2026-46656HIGHBludit CMS has improper authorization and mediation failure leading to persistent ghost sessionsEPSS 0.3%