What is the CVSS score of CVE-2026-34572?

CVE-2026-34572 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Ci4ms are affected by CVE-2026-34572?

CI4MS (CodeIgniter 4 CMS) versions prior to 0.31.0.0 contain a session fixation vulnerability that allows deactivated user accounts to retain full system access indefinitely, creating a critical…. A patch is available.

How to fix or mitigate CVE-2026-34572?

Within 24 hours: Inventory all CI4MS deployments and document current version numbers; identify deactivated user accounts created in the past 90 days and force immediate session termination via database or CMS administrative backend. Within 7 days: Implement mandatory account logout on administrative deactivation by developing a custom patch or deploying an authentication middleware that invalidates all sessions for disabled users on each request; monitor login/audit logs for anomalous activity from deactivated accounts. Within 30 days: Upgrade to CI4MS 0.31.0.0 or later when available; conduct access review of all deactivated accounts to detect unauthorized activity.

Ci4ms CVE-2026-34572

EUVD-2026-18089 HIGH

Improper Access Control (CWE-284)

2026-04-01 GitHub_M

GHSA-8fq3-c5w3-pj3q

Authentication Bypass Ci4ms Ci4 Cms Erp

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 02, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 01, 2026 - 22:16 euvd

EUVD-2026-18089

Analysis Generated

Apr 01, 2026 - 22:16 vuln.today

CVE Published

Apr 01, 2026 - 21:35 nvd

HIGH 8.8

DescriptionGitHub Advisory

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to immediately revoke active user sessions when an account is deactivated. Due to a logic flaw in the backend design, account state changes are enforced only during authentication (login), not for already-established sessions. The system implicitly assumes that authenticated users remain trusted for the lifetime of their session. There is no session expiration or account expiration mechanism in place, causing deactivated accounts to retain indefinite access until the user manually logs out. This behavior breaks the intended access control policy and results in persistent unauthorized access, representing a critical security flaw. This issue has been patched in version 0.31.0.0.

AnalysisAI

Session fixation vulnerability in CI4MS (CodeIgniter 4 CMS) allows deactivated user accounts to maintain indefinite access through active sessions. Authenticated attackers whose accounts have been administratively disabled retain full high-privilege access (confidentiality, integrity, availability impact) until manual logout, bypassing intended access controls. Affects all versions prior to 0.31.0.0. EPSS data not available; no public exploit identified at time of analysis. CVSS 8.8 (High) reflects significant post-compromise persistence risk in enterprise CMS deployments with role-based access control.

Technical ContextAI

CI4MS implements role-based access control (RBAC) atop CodeIgniter 4's session management framework. The vulnerability stems from CWE-284 (Improper Access Control) where authentication state validation occurs only at login boundaries, not during session lifecycle management. CodeIgniter 4's native session handlers maintain server-side session data with client-side cookies, but the application layer failed to implement account state verification middleware for established sessions. The architectural flaw treats session tokens as immutable authorization credentials rather than dynamic references requiring real-time account status validation. The affected product (cpe:2.3:a:ci4-cms-erp:ci4ms) is a production CMS skeleton designed for enterprise content management with modular architecture and theme support, making session persistence vulnerabilities particularly impactful in multi-user environments with administrative oversight.

RemediationAI

Upgrade immediately to CI4MS version 0.31.0.0 or later, which implements session invalidation logic tied to account state changes. The patched release is available at https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0 and addresses the session lifecycle management flaw by adding real-time account status verification for active sessions. Organizations unable to immediately upgrade should implement compensating controls: enforce aggressive session timeout policies (reduce session lifetime to 15-30 minutes), implement manual session termination procedures when deactivating accounts (database-level session purging), enable comprehensive session activity logging to detect deactivated account usage, and consider deploying reverse proxy authentication layers that validate account status independently of application sessions. Review audit logs for any instances of deactivated accounts maintaining access post-deactivation and treat as potential security incidents requiring investigation. Post-upgrade, verify session behavior by deactivating test accounts and confirming immediate access revocation without requiring logout.