PT-2026-6301 · Ci4Ms · Ci4Ms

Far-Horizons · Published 2026-02-02 · Updated 2026-02-04 · CVE-2026-25509

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions CI4MS versions prior to 0.28.5.0

Description CI4MS, a CodeIgniter 4-based CMS skeleton, contains a flaw in its authentication implementation that allows an unauthenticated attacker to determine if an email address is registered within the system. This is achieved by observing the application’s response during the password reset process. The affected system delivers a production-ready, modular architecture with RBAC authorization and theme support.

Recommendations Update to version 0.28.5.0 or later.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

CWE-204

Related Identifiers

CVE-2026-25509

GHSA-654X-9Q7R-G966

Affected Products

Ci4Ms

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25509.json · Exploit
• https://github.com/ci4-cms-erp/ci4ms/commit/86be2930d1c54eb7575102563302b2f3bafcb653 · Patch
• https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-654x-9q7r-g966 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25509 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25509 · Security Note
• https://osv.dev/vulnerability/GHSA-654x-9q7r-g966 · Vendor Advisory
• https://github.com/ci4-cms-erp/ci4ms · Note
• https://t.me/CVEtracker/43660 · Telegram Post
• https://twitter.com/CVEnew/status/2018913270992605656 · Twitter Post