Executive brief
Bludit is a content management system used to build and manage websites. A security flaw allows users whose accounts have been disabled by an administrator to continue accessing the system if they have a 'Remember Me' cookie active. This means a terminated employee or revoked user could still modify site content or access private data despite their account being officially deactivated.
Technical details
A vulnerability exists in the user management logic of Bludit CMS within the disableUser() function in bl-kernel/users.class.php. While the application invalidates the password field by prefixing it with a '!' character, it fails to clear the tokenAuth and tokenRemember fields in the JSON database (bl-content/databases/users.php). An attacker with a pre-existing, valid 'Remember Me' cookie can bypass the account disablement because the authentication subsystem validates the cookie against the uncleared database tokens. This allows a deactivated user to maintain a valid session with their original privileges. The issue is resolved in version 3.22.0 by ensuring these tokens are cleared upon account deactivation.
Affected products
- Bludit Bludit < 3.22.0
Timeline
- 2026-05-11: patched: Version 3.22.0 released
- 2026-05-19: advisory: GitHub Security Advisory published
- 2026-06-08: disclosed: CVE published to NVD