CVE-2026-34570 Details
Description
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to immediately revoke active user sessions when an account is deleted. Due to a logic flaw in the backend design, account state changes are enforced only during authentication (login), not for already-established sessions. The system implicitly assumes that authenticated users remain trusted for the lifetime of their session. There is no session expiration or account expiration mechanism in place, causing deleted accounts to retain indefinite access until the user manually logs out. This behavior breaks the intended access control policy and results in persistent unauthorized access. This issue has been patched in version 0.31.0.0.
A logic flaw in CI4MS, a CodeIgniter 4-based CMS, allows deleted user accounts to retain active sessions, leading to persistent unauthorized access. This issue affects versions through 0.28.6.0. The vulnerability arises because the application only enforces account state changes during login, not for established sessions. As a result, deleted accounts can access all functionalities, including administrative interfaces, until the user manually logs out. This behavior violates the intended access control policy and has been addressed in version 0.31.0.0.
To address this vulnerability, CI4MS has released a patch in version 0.31.0.0. Users should update to this version to ensure that active sessions are invalidated immediately upon account deletion.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0 | [email protected] | Release Notes |
| https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-4vxv-4xq4-p84h | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1254 | Incorrect Comparison Logic Granularity | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
| CWE-613 | Insufficient Session Expiration | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ci4-cms-erp ci4ms | < 0.31.0.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 6, 2026 | CVE Modified | [email protected] |
| Apr 6, 2026 | Initial Analysis | [email protected] |
| Apr 1, 2026 | New CVE Received | [email protected] |