EUVD-2026-18086
GHSA-4vxv-4xq4-p84h
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to immediately revoke active user sessions when an account is deleted. Due to a logic flaw in the backend design, account state changes are enforced only during authentication (login), not for already-established sessions. The system implicitly assumes that authenticated users remain trusted for the lifetime of their session. There is no session expiration or account expiration mechanism in place, causing deleted accounts to retain indefinite access until the user manually logs out. This behavior breaks the intended access control policy and results in persistent unauthorized access. This issue has been patched in version 0.31.0.0.
AnalysisAI
Session persistence in CI4MS (CodeIgniter 4 CMS skeleton) allows deleted user accounts to retain full system access indefinitely through active sessions until manual logout. Affects all versions prior to 0.31.0.0. The authentication bypass enables unauthorized access to protected resources with high confidentiality, integrity, and availability impact across both vulnerable and subsequent systems (CVSS 10.0 Critical). No public exploit identified at time of analysis, though the vulnerability mechanism is straightforward to abuse by maintaining an active session before account deletion.
Technical ContextAI
CI4MS is a production-ready CMS skeleton built on the CodeIgniter 4 PHP framework, implementing role-based access control (RBAC) and modular architecture. The vulnerability stems from CWE-284 (Improper Access Control) where session validation logic only verifies account status during initial authentication at login time. Once a session token is issued, the application fails to perform subsequent account state checks during request processing. This design flaw means the session management layer operates independently from the user account lifecycle, lacking middleware to validate that the account associated with a session token still exists and remains active. The affected component is cpe:2.3:a:ci4-cms-erp:ci4ms (all versions before 0.31.0.0), suggesting the issue is endemic to the core session handling architecture rather than a specific code defect.
RemediationAI
Upgrade to CI4MS version 0.31.0.0 or later, which includes patches to enforce session invalidation upon account deletion. The patched release is available at https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0 per the vendor advisory at https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-4vxv-4xq4-p84h. As an interim mitigation for environments unable to upgrade immediately, implement manual session revocation procedures when deleting user accounts by purging session data from the application's session store (typically database or file-based) and clearing any server-side session caches. Organizations should audit recent account deletions to identify potentially active orphaned sessions and force global session invalidation if unauthorized access is suspected. Consider implementing session timeout policies and periodic re-authentication requirements to limit the window of exposure for similar session management gaps.
CI4MS (CodeIgniter 4 CMS skeleton) has a code injection vulnerability (CVSS 9.9) allowing authenticated users to execute
Stored cross-site scripting in CI4MS backend user management allows authenticated attackers with low-level privileges to
Stored cross-site scripting in CI4MS blog category management allows authenticated users to inject malicious JavaScript
Environment file injection in CI4MS versions prior to 0.31.4.0 allows remote attackers to inject arbitrary configuration
Stored cross-site scripting in CI4MS blog module allows authenticated attackers to inject malicious JavaScript that exec
Stored cross-site scripting in CI4MS (CodeIgniter 4 CMS) allows authenticated users with blog post management privileges
Stored cross-site scripting (XSS) in CI4MS page management functionality allows authenticated attackers to inject malici
Stored cross-site scripting (XSS) in CI4MS menu management allows authenticated users with low privileges to inject mali
Stored cross-site scripting in CI4MS menu management allows authenticated attackers to inject malicious scripts that exe
Stored blind cross-site scripting in CI4MS backup management allows authenticated attackers to inject malicious JavaScri
Stored Cross-Site Scripting in CI4MS methods management allows authenticated users to inject malicious JavaScript into a
Stored cross-site scripting in CI4MS role/group management allows authenticated attackers to inject malicious JavaScript
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today