PT-2026-29636 · Ci4Ms · Ci4Ms

Bugmithlegend · Published 2026-04-01 · Updated 2026-04-02 · CVE-2026-34572

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CI4MS versions prior to 0.31.0.0

Description The application does not immediately revoke active user sessions when an account is deactivated. This is due to a logic flaw where account state changes are only enforced during login, not for existing sessions. The system assumes authenticated users remain trusted indefinitely, lacking session or account expiration mechanisms. This allows deactivated accounts to retain access until manual logout, breaking access control and resulting in unauthorized access. This issue affects all authenticated endpoints, including administrative and content interfaces.

Recommendations Immediately invalidate all active sessions when an account is deactivated. Enforce account status checks on every authenticated request. Introduce session expiration or account expiration mechanisms. Correct the backend logic flaw to ensure access control aligns with security design.

Exploit

Fix

Insufficient Session Expiration

Improper Access Control

Weakness Enumeration

CWE-1254

CWE-613

CWE-284

Related Identifiers

CVE-2026-34572

GHSA-8FQ3-C5W3-PJ3Q

Affected Products

Ci4Ms

References · 8

• 🔥 https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-8fq3-c5w3-pj3q · Exploit
• https://osv.dev/vulnerability/GHSA-8fq3-c5w3-pj3q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34572 · Security Note
• https://github.com/ci4-cms-erp/ci4ms · Note
• https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0 · Note
• https://twitter.com/CVEnew/status/2039647739924107376 · Twitter Post
• https://twitter.com/CveFindCom/status/2039677918872228144 · Twitter Post
• https://twitter.com/TheHackerWire/status/2039524129049878802 · Twitter Post