CVE-2026-46656: Bludit CMS has improper authorization and mediation failure leading to persistent ghost sessions

Synopsis

An improper authorization flaw in Bludit CMS (versions before 3.22.0) allows session tokens belonging to deleted user accounts to remain fully valid, granting those accounts continued access to the system as so-called ghost sessions. The vulnerability is reachable over the network and requires only a low-privilege account credential, meaning any user whose account was deleted but whose session token was not explicitly invalidated retains complete access. Successful exploitation gives the attacker full read, write, and administrative access to the CMS, equivalent to an active authenticated user. HarborGuard tracks this advisory and will make a patched-image rebuild available at version 3.22.0 the moment an upstream fix is confirmed published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Bludit service over the network; there is no requirement for local or physical access.

• AuthenticationRequired

  A low-privilege account is sufficient; the attacker only needs a valid session token that was issued before the account was deleted.

• Victim interactionNot required

  No user interaction is needed; the attacker exercises the ghost session directly without involving another party.

• Attack complexityDetail

  Exploitation is reliable and condition-free once a valid session token is in hand; no race conditions or special environmental factors are required.

Blast Radius

• Reads all CMS content, stored credentials, and configuration data accessible to the deleted account.
• Modifies or deletes published pages, posts, and site settings within the CMS.
• Creates or manipulates user accounts and access controls if the ghost session carried sufficient privileges.
• Disrupts normal CMS operation by altering or removing critical configuration files or content.