Loading vulnerability…
CI4MS session revocation flaw for deleted accounts
CVE-2026-34570 affects CI4MS, a CodeIgniter 4-based CMS skeleton, in versions prior to 0.31.0.0. The vulnerability is caused by a backend logic flaw in which account state changes, specifically account deletion, are enforced only at authentication time and are not revalidated for already-established sessions. As a result, when an account is deleted, any active session associated with that account remains valid instead of being immediately revoked. Because the application also lacked session expiration or account expiration controls in the described scenario, a deleted user could continue accessing the application indefinitely until manually logging out. This breaks the intended access control model and results in persistent unauthorized access by accounts that should no longer be valid.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker or former user with an already-authenticated session can continue to access CI4MS after the associated account has been deleted. This results in unauthorized persistence of access and undermines account lifecycle enforcement and RBAC expectations. Depending on the permissions held by the deleted account at the time the session was established, the issue can expose confidentiality, integrity, and availability impacts through continued access to protected application functionality and data.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, implement compensating controls to forcibly invalidate all active sessions when an account is deleted or disabled. Add server-side checks on each request, or at least on privileged actions, to verify that the backing account still exists and remains authorized. Introduce session expiration and administrative session revocation capabilities to reduce the window of exposure for stale authenticated sessions.
Patch, then assume compromise.
Upgrade CI4MS to version 0.31.0.0 or later, where the issue has been patched. The fix should ensure that account deletion immediately invalidates all active sessions associated with the deleted account and that session validity is rechecked against current account state rather than being trusted solely based on successful past authentication.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.