CVE-2026-46656

creationtimestamp| type| source ---|---|--- 2026-06-08 17:00:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mns5t6aszh2s 2026-06-08 17:02:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mns5w7ytr72f...

CVE-2026-46656

Bludit CMS versions prior to 3.22.0 are affected by a Broken Access Control issue where active sessions remain valid after the corresponding user account is deleted (the “Ghost Session”). This allows revoked users to maintain full unauthorized access. The issue is fixed in version 3.22.0. Affecte...