# CVE-2026-46656: Bludit CMS broken access control via ghost sessions

Source: https://junglewise.ai/threats/cve-2026-46656-bludit-cms-broken-access-control-via-ghost-sessions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-08. Updated: 2026-06-08  
License: CC BY 4.0 with a link back

CVE-2026-46656 · Severity: high · CVSS 8.8 · Published 2026-06-08

Bludit, a content management system used for building websites, contains a security flaw where user sessions remain active even after an account has been deleted or disabled. This allows a removed user to maintain full access to the website, potentially allowing them to steal data, modify content, or create new administrative accounts to regain permanent control. Organizations using Bludit should update to version 3.22.0 to ensure that revoked users are immediately disconnected.

Technologies: [Bludit](https://junglewise.ai/threats/technologies/bludit). Vendors: [Bludit](https://junglewise.ai/threats/vendors/bludit).

## Quick answers

**Is CVE-2026-46656 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46656 being exploited in the wild.

**How severe is CVE-2026-46656?** High severity, with a CVSS score of 8.8, published 8 June 2026.

**Which products and versions are affected?** Bludit < 3.22.0.

**Is there a fix for CVE-2026-46656?** A patch was published on 2026-05-11: Version 3.22.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46656 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-46656?** Check whether you run Bludit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Bludit CMS prior to version 3.22.0 suffers from improper authorization (CWE-285) and insufficient session expiration (CWE-613) within the isLogged() function in bl-kernel/login.class.php. The application relies on server-side session state (the $_SESSION global variable) without re-validating the user's existence or status against the database for subsequent requests. An attacker with an existing session can maintain access even after their account is physically deleted from the JSON database. This allows for persistent unauthorized actions, including privilege escalation by creating new administrative accounts from a deleted session. The issue is resolved in version 3.22.0 by modifying isLogged() to verify the subject's legitimacy against the user database for every request.

## Affected products

- Bludit Bludit < 3.22.0

## Timeline

- 2026-05-11: patched: Version 3.22.0 released
- 2026-05-19: advisory: GitHub Security Advisory published
- 2026-06-08: disclosed: CVE published to NVD

## References

- [https://github.com/bludit/bludit/commit/7931d1c55a3cc535911a9901c328f0197afe1c9f](https://github.com/bludit/bludit/commit/7931d1c55a3cc535911a9901c328f0197afe1c9f)
- [https://github.com/bludit/bludit/releases/tag/3.22.0](https://github.com/bludit/bludit/releases/tag/3.22.0)
- [https://github.com/bludit/bludit/security/advisories/GHSA-rpq2-j9w3-h4jw](https://github.com/bludit/bludit/security/advisories/GHSA-rpq2-j9w3-h4jw)

## Related threats

- [Bludit stored cross-site scripting in logo upload](https://junglewise.ai/threats/cve-2026-72576-bludit-stored-cross-site-scripting-in-logo-upload)
- [Bludit directory traversal in api/plugin.php](https://junglewise.ai/threats/cve-2026-50869-bludit-directory-traversal-in-api-plugin-php)
- [Bludit CMS remote code execution in API Plugin](https://junglewise.ai/threats/cve-2026-38329-bludit-cms-remote-code-execution-in-api-plugin)
- [Bludit insufficient session expiration for disabled accounts](https://junglewise.ai/threats/cve-2026-46657-bludit-insufficient-session-expiration-for-disabled-accounts)
- [Bludit CMS reflected XSS in search plugin](https://junglewise.ai/threats/cve-2026-41456-bludit-cms-reflected-xss-in-search-plugin)