CVE-2026-41891 Details

A session management vulnerability has been identified in CI4MS, a CodeIgniter 4-based CMS, affecting versions 0.26.0 prior to 0.31.8.0. The issue arises because the authentication filter does not properly check the status of deactivated or banned users. When an admin deactivates a user, their session remains active, allowing continued access until the session expires. This vulnerability exists because the 'active' user status check was inadvertently disabled, leaving a gap in session management for deactivated users.

Users are advised to upgrade to CI4MS version 0.31.8.0, which restores proper session management by verifying user account status on every request, ensuring that deactivated users cannot maintain active sessions.