CVE-2026-46657: Bludit's persistent authentication tokens not revoked upon account disablement

Synopsis

This is an authentication-bypass vulnerability in Bludit, an open-source flat-file content management system. It is reachable over the network by any user who holds a low-privilege account (or had one before it was disabled), and no further victim interaction is required. Successful exploitation lets a deactivated user maintain a fully authenticated session, bypassing the administrator's intent to revoke access and retaining read access to protected content along with limited write capability. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Bludit application over the network; any internet-exposed or internally routable Bludit instance is in scope.

• AuthenticationRequired

  The attacker must hold (or have previously held) a low-privilege Bludit account, because the bypass relies on a persistent token issued to that account before disablement.

• Victim interactionNot required

  No victim action is needed; the attacker replays their existing Remember Me cookie autonomously.

• Attack complexityDetail

  The exploit is reliable and condition-free: the attacker simply presents the stored cookie, with no race condition or environmental prerequisite involved.

Blast Radius

• A deactivated user retains a fully authenticated session and can read protected CMS content, including unpublished drafts and any data accessible to their original role.
• The attacker can perform limited write operations consistent with their former account privileges, such as modifying or creating content, depending on the role assigned before disablement.
• Administrator-initiated access revocation is silently ineffective, meaning security-incident containment actions (disabling a compromised or departing user) do not achieve their intended result.