Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-41891

CI4MS: Deactivated User Session Bypass (active=0)

Description

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. From version 0.26.0 to before version 0.31.8.0, the auth filter has the deactivated/banned user check commented out. This issue has been patched in version 0.31.8.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ci4-cms-erp ci4ms

  • >= 0.26.0, < 0.31.8.0affected

References