PT-2026-29634 · Ci4Ms · Ci4Ms

Bugmithlegend · Published 2026-04-01 · Updated 2026-04-01 · CVE-2026-34570

Positive Technologies · (AI Summary)

CVSS v4.0

10

Critical

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions CI4MS versions prior to 0.31.0.0

Description The application does not immediately revoke active user sessions when an account is deleted. This is due to a logic flaw where account state changes are only enforced during login, not for existing sessions. The system incorrectly assumes authenticated users remain trustworthy even after account deletion, leading to indefinite access until manual logout. This breaks access control and allows persistent unauthorized access. The issue affects all authenticated endpoints, including administrative and content interfaces.

Recommendations Immediately invalidate all active sessions when an account is deleted. Enforce account status checks on every authenticated request, not only during login. Introduce proper session expiration or account expiration mechanisms to prevent indefinite access. Correct the backend logic flaw to ensure access control behavior aligns with intended security design and does not rely on unsafe trust assumptions.

Fix

Insufficient Session Expiration

Improper Access Control

Weakness Enumeration

CWE-1254

CWE-613

CWE-284

Related Identifiers

CVE-2026-34570

GHSA-4VXV-4XQ4-P84H

Affected Products

Ci4Ms

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-34570 · Security Note
• https://osv.dev/vulnerability/GHSA-4vxv-4xq4-p84h · Vendor Advisory
• https://github.com/ci4-cms-erp/ci4ms · Note
• https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0 · Note
• https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-4vxv-4xq4-p84h · Note