CI4MS Flaws Enable Persistent Access and Admin Account Compromise
Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Apr 2, 2026
CI4MS, a CodeIgniter 4-based CMS skeleton, was found to contain two critical vulnerabilities affecting versions prior to 0.31.0.0. One flaw, tracked as CVE-2026-34572, allowed users with existing sessions to remain authenticated after their accounts were deactivated because account status was only enforced at login. With no session expiration or account expiration controls in place, deactivated users could keep accessing the application indefinitely until they manually logged out, undermining intended access restrictions across all roles.
A second issue, CVE-2026-34571, exposed the platform to stored cross-site scripting in backend user management. Improper sanitization of user-supplied input allowed persistent JavaScript to execute automatically when administrators viewed affected pages, creating a path to session hijacking, privilege escalation, and full administrative account compromise. Both vulnerabilities were addressed in CI4MS version 0.31.0.0.
