Bludit CMS versions earlier than 3.22.0 allow an existing user session to continue after the corresponding account has been removed from the database. The persistence of the session is a broken access control flaw that permits revoked or deleted users to retain full system privileges. This weakness is identified as CWE-285 and CWE-613 and can result in unauthorized data modification, retrieval, or deployment of new content.

The affected product is bludit:bludit. Versions prior to 3.22.0 are vulnerable, as the patch in the 3.22.0 release removes the ghost session behavior. Systems running these earlier releases should be identified and updated accordingly.

The CVSS v3.1 score of 8.8 classifies the vulnerability as High severity, indicating significant impact. The EPSS score is not available, but the lack of presence in the CISA KEV catalog suggests limited exploitation reports to date. The likely attack vector involves an attacker with temporary access to a valid session cookie before the user account is deleted; after the deletion the session still grants full control until it expires or the server restarts. As the flaw persists after account removal and requires no special privileges beyond the existing session, it can be exploited by anyone who obtains or retains a valid session token.