Read the docs
TI-2026-34302 Aliases CVE-2026-46657

Bludit's persistent authentication tokens not revoked upon account disablement

Priority MEDIUM 64CWE-212Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-613.

Summary

Bludit is a content management system. Versions prior to 3.22.0 have a vulnerability in the user management logic that allows deactivated accounts to maintain access via persistent authentication tokens. When an administrator disables a user account, the application fails to invalidate or clear the associated tokenAuth and tokenRemember fields in the JSON database. Consequently, any user with a pre-existing "Remember Me" cookie can bypass the account disablement and maintain a valid authenticated state. Version 3.22.0 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00271 19th percentileScored 2026-11-07
Fix Fixed bludit (bludit): 3.22.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Bluditbluditbefore 3.22.03.22.0Patch availableCNA
  • bludit VendorBludit Affected before 3.22.0 Fixed in 3.22.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:bludit:bludit:*:*:*:*:*:*:*:*——Bludit
  • cpe:2.3:a:bludit:bludit:*:*:*:*:*:*:*:* Versions — — ·Bludit

Remediation

  • Fix · CNA bludit (bludit) Fixed in 3.22.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-46657

References

Other 2

  • TI-2019-12105 Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because… CVSS 3.1HIGH 8.8
  • TI-2024-16173 Bludit - Remote Code Execution (RCE) through Image API CVSS 4.0HIGH 8.9
  • TI-2024-16172 Bludit - Remote Code Execution (RCE) through File API CVSS 4.0HIGH 8.9
  • TI-2026-34301 Bludit CMS has improper authorization and mediation failure leading to persistent ghost sessions CVSS 3.1HIGH 8.8
  • TI-2023-15122 An issue in Bludit 4.0.0-rc-2 allows authenticated attackers to change the Administrator… CVSS 3.1HIGH 8.8
  • TI-2020-13782 Bludit 3.9.2 is vulnerable to Remote Code Execution (RCE) via /admin/ajax/upload-images. CVSS 3.1HIGH 8.8
See all 48 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences