CVE-2026-46657

The record

Bludit is a content management system. Versions prior to 3.22.0 have a vulnerability in the user management logic that allows deactivated accounts to maintain access via persistent authentication tokens. When an administrator disables a user account, the application fails to invalidate or clear the associated tokenAuth and tokenRemember fields in the JSON database. Consequently, any user with a pre-existing "Remember Me" cookie can bypass the account disablement and maintain a valid authenticated state. Version 3.22.0 patches the issue.

Affected packages

Related vulnerabilities

• CVE-2026-111756 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows… CWE-212
• CVE-2026-53604 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. CWE-212
• CVE-2026-78658 IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.25, and 7.3 through 7.3.2.20 and IBM UCD… CWE-212
• CVE-2026-85094 The Canva Android App before 2.376.0 did not restrict the headers returned to an external… CWE-212
• CVE-2026-62900 Improper removal of sensitive information before storage or transfer in .NET allows an… CWE-212
• CVE-2024-5300 An access control bypass and information disclosure vulnerability exists in the base… CWE-212
• CVE-2026-15811 A vulnerability was found in kronosnet's (version <=1.34) cryptographic configuration… CWE-212
• CVE-2026-54421 In OpenStack Ironic through 35.0.1, when applying a PATCH to update fields in volume… CWE-212