CVE-2026-34572 Details
Description
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to immediately revoke active user sessions when an account is deactivated. Due to a logic flaw in the backend design, account state changes are enforced only during authentication (login), not for already-established sessions. The system implicitly assumes that authenticated users remain trusted for the lifetime of their session. There is no session expiration or account expiration mechanism in place, causing deactivated accounts to retain indefinite access until the user manually logs out. This behavior breaks the intended access control policy and results in persistent unauthorized access, representing a critical security flaw. This issue has been patched in version 0.31.0.0.
A logic flaw in CI4MS, a CodeIgniter 4-based CMS skeleton, allows deactivated user accounts to retain active sessions indefinitely. Prior to version 0.31.0.0, the application did not immediately revoke sessions when an account was deactivated, instead enforcing account state changes only during login. This flaw breaks the access control policy, allowing users to continue accessing all functionalities, including administrative interfaces, as if their accounts were still active. The vulnerability arises from the assumption that authenticated users remain trustworthy for the duration of their sessions, without any mechanism for session or account expiration.
Users are advised to update to version 0.31.0.0, where this vulnerability has been patched. After updating, it is recommended to back up the database and run 'composer update' before upgrading.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-8fq3-c5w3-pj3q | CISA-ADP | ExploitVendor Advisory |
| https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0 | [email protected] | Release Notes |
| https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-8fq3-c5w3-pj3q | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1254 | Incorrect Comparison Logic Granularity | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
| CWE-613 | Insufficient Session Expiration | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ci4-cms-erp ci4ms | < 0.31.0.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 6, 2026 | Initial Analysis | [email protected] |
| Apr 2, 2026 | CVE Modified | CISA-ADP |
| Apr 1, 2026 | New CVE Received | [email protected] |