VulnerabilityDeferred

CVE-2026-46656

This "Ghost Session" allows revoked users to maintain full unauthorized access to the system.

HIGH 8.8EPSS 0.29%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.29%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Bludit is a content management system. Versions prior to 3.22.0 have a Broken Access Control flaw where active sessions remain valid even after the corresponding user account has been physically deleted from the database. This "Ghost Session" allows revoked users to maintain full unauthorized access to the system. Version 3.22.0 fixes the issue.

CVSS 3.1: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.29% probability · 22th percentile
CISA KEV: Not listed
Weakness: CWE-285, CWE-613
Source: security-advisories@github.com

References

https://github.com/bludit/bludit/commit/7931d1c55a3cc535911a9901c328f0197afe1c9f
https://github.com/bludit/bludit/releases/tag/3.22.0
https://github.com/bludit/bludit/security/advisories/GHSA-rpq2-j9w3-h4jw
https://github.com/bludit/bludit/security/advisories/GHSA-rpq2-j9w3-h4jw

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.