Session Management Flaw in CI4MS by CodeIgniter 4

CVE-2026-34572

What is CVE-2026-34572?

CI4MS, a CMS framework built on CodeIgniter 4, suffers from a session management flaw that prevents the immediate revocation of user sessions upon account deactivation. This issue arises from a design flaw where session integrity is not enforced beyond the authentication phase, allowing users with deactivated accounts to maintain access indefinitely until manually logging out. This weakness compromises the platform's access controls, leading to potential unauthorized usage of the application by deactivated accounts. The critical issue has been addressed in version 0.31.0.0, emphasizing the importance of timely patching for maintaining security.

References