CVE-2026-46656

8.8 Élevée

Publiée le 08/06/2026 à 18:16 · Modifiée le 23/07/2026 à 09:10 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Bludit is a content management system. Versions prior to 3.22.0 have a Broken Access Control flaw where active sessions remain valid even after the corresponding user account has been physically deleted from the database. This "Ghost Session" allows revoked users to maintain full unauthorized access to the system. Version 3.22.0 fixes the issue.

Traduire en français

Produits concernés

bludit

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.8 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-285
CWE-613

Références

https://github.com/bludit/bludit/commit/7931d1c55a3cc535911a9901c328f0197afe1c9f
https://github.com/bludit/bludit/releases/tag/3.22.0
https://github.com/bludit/bludit/security/advisories/GHSA-rpq2-j9w3-h4jw
https://github.com/bludit/bludit/security/advisories/GHSA-rpq2-j9w3-h4jw

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories