CI4MS Flaws Enable Account Takeover and Persistent Access After Deletion

CI4MS, a CodeIgniter 4-based CMS skeleton, patched two high-severity vulnerabilities in version 0.31.0.0 that could let attackers compromise accounts and bypass intended access controls. CVE-2026-34557 affects versions before that release and stems from improper sanitization in group and role management fields, allowing attackers with low privileges to inject malicious JavaScript that is later rendered in privileged administrative views. The stored DOM XSS can be used in the permissions-management context to escalate privileges and potentially achieve full account takeover across roles.

A second flaw, CVE-2026-34570, allowed deleted users to keep using already-active sessions because account deletion did not invalidate existing authentication tokens or sessions. In affected versions prior to 0.31.0.0, access checks were enforced only at login, so a removed account could retain unauthorized access until the session ended or the user logged out manually. The issue undermined access control and exposed confidentiality, integrity, and availability until the vendor corrected session handling in the patched release.