CVE-2026-25509: 
PHP vulnerability analysis and mitigation

CVE-2026-25509 is a user email enumeration vulnerability in CI4MS, a CodeIgniter 4-based CMS skeleton with RBAC authorization and theme support. An unauthenticated attacker can determine whether an email address is registered in the system by analyzing differing application responses during the password reset process. All CI4MS versions prior to 0.28.5.0 are affected. The vulnerability was published on February 2, 2026, and patched in version 0.28.5.0. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Security Advisory).

The root cause is classified under CWE-204 (Observable Response Discrepancy) and CWE-203 (Observable Discrepancy). In the vulnerable forgotPassword() method of AuthController.php, the application returns a distinct error message (e.g., lang('Auth.forgotNoUser')) when a submitted email is not found in the database, versus a success message (e.g., "Password reset link has been sent") when the email exists. This behavioral difference is observable over the network with no authentication, no special privileges, and no user interaction required. The fix, applied in commit 86be293, replaces the distinct error response with the same generic success-style message (lang('Auth.forgotEmailSent')) regardless of whether the email exists (Patch Commit, GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to programmatically build a list of valid registered email addresses by iterating submissions to the password reset endpoint and comparing responses. This enumerated data can be weaponized for targeted phishing campaigns, social engineering, or credential brute-force attacks against confirmed valid accounts. There is no direct integrity or availability impact; the confidentiality impact is limited to the disclosure of whether specific email addresses are registered in the system (GitHub Advisory, Security Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The attack requires no authentication, no user interaction, and can be fully automated using simple HTTP scripting tools. The EPSS score is approximately 0.044% (0.000440), indicating a low near-term exploitation probability. This vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Reconnaissance: Identify a publicly accessible CI4MS installation running a version prior to 0.28.5.0. The application may be discoverable via web search or Shodan using CI4MS-specific fingerprints.
2. Locate the password reset endpoint: Navigate to the CI4MS password reset page, typically at a URL such as /auth/forgot-password or equivalent.
3. Baseline the responses: Submit a known non-existent email address (e.g., nonexistent@example.com) and record the HTTP response body and status code — this establishes the "not found" response baseline.
4. Enumerate email addresses: Using an automated script (e.g., Python requests library or ffuf), submit a list of candidate email addresses to the password reset endpoint in rapid succession.
5. Identify valid accounts: Compare each response against the baseline. Responses that differ (e.g., a success message such as "Password reset link has been sent" vs. "User not found") indicate that the submitted email is registered in the system.
6. Leverage enumerated emails: Use the confirmed valid email list for targeted phishing, credential stuffing, or brute-force attacks against the CI4MS login endpoint (Security Advisory).

• Network: High volume of POST requests to the CI4MS password reset endpoint (e.g., /auth/forgot-password) from a single IP address or a rotating set of IPs in a short time window; requests containing varied email addresses in the POST body.
• Logs: Web server access logs showing repeated password reset form submissions with sequential or dictionary-based email addresses, particularly with consistent timing patterns indicative of automation; HTTP 200 responses mixed with redirect responses to the same endpoint from the same source.
• Application Behavior: Unusual spike in password reset request volume without a corresponding increase in legitimate user activity or password reset email delivery.

Upgrade CI4MS to version 0.28.5.0 or later, which implements a uniform generic response for all password reset requests regardless of whether the submitted email exists in the database. As a workaround for installations that cannot be immediately upgraded, administrators should manually modify modules/Auth/Controllers/AuthController.php to replace the distinct lang('Auth.forgotNoUser') error response with the same generic message used for successful submissions (e.g., lang('Auth.forgotEmailSent')). Additionally, implementing rate limiting on the password reset endpoint can reduce the risk of automated enumeration (Patch Commit, GitHub Advisory).

The vulnerability was reported by security researcher Lars van Mil (GitHub: Far-Horizons), who was credited in the CI4MS Security Hall of Fame for identifying this and related vulnerabilities. The maintainer acknowledged the report promptly and released a patch in version 0.28.5.0 shortly after disclosure. No significant broader media coverage or notable community discussion beyond the GitHub advisory has been identified (Patch Commit, Security Advisory).