CVE-2026-34570: 
PHP vulnerability analysis and mitigation

CVE-2026-34570 is an improper session invalidation vulnerability in CI4MS, a CodeIgniter 4-based CMS skeleton, that allows deleted user accounts to retain full application access indefinitely. The flaw affects all CI4MS versions up to and including 0.28.6.0 (prior to 0.31.0.0). It was published on April 1, 2026, with a patch released on March 29, 2026 in version 0.31.0.0. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory).

The root cause is a logic flaw in the backend session management, classified under CWE-284 (Improper Access Control), CWE-613 (Insufficient Session Expiration), and CWE-1254 (Incorrect Comparison Logic Granularity). Account state changes — including deletion — are enforced only at authentication time (login), not validated against active sessions on subsequent requests. This means the system implicitly trusts any already-authenticated session for its entire lifetime, with no mechanism to invalidate sessions server-side when an account is removed. An attacker (or a user whose account is deleted) can exploit this by simply maintaining their existing authenticated session, requiring only low-level prior authentication (GitHub Advisory).

A user whose account has been administratively deleted retains full access to all protected application functionality — including RBAC-controlled resources — until they manually log out or their session naturally expires. This breaks the intended access control policy and constitutes persistent unauthorized access, potentially exposing sensitive data and allowing unauthorized modifications across all roles. The confidentiality, integrity, and availability impacts are all rated High, as the retained session preserves the user's original privilege level (GitHub Advisory, Feedly).

A proof-of-concept (PoC) with step-by-step reproduction instructions is publicly available in the GitHub Security Advisory, including a reference to a video PoC. The EPSS score is approximately 0.083%, indicating low predicted exploitation probability in the near term. There is no evidence of in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA KEV catalog. No threat actor attribution has been reported (GitHub Advisory, Feedly).

1. Obtain a valid account: Create or use an existing user account on a CI4MS instance running a version prior to 0.31.0.0.
2. Authenticate: Log into the application using the target account credentials, establishing an active session.
3. Trigger account deletion: From a separate administrative account (or by social engineering an admin), delete the authenticated user's account via the Account Deletion Module.
4. Observe persistent access: Return to the original session and confirm that the application still treats the user as authenticated — no redirect to login, no session termination.
5. Access protected resources: Navigate to RBAC-protected functionality (e.g., admin panels, data management modules) and verify continued access with original privileges.
6. Maintain access indefinitely: Continue using the session until a manual logout is performed, as no server-side session invalidation occurs (GitHub Advisory).

• Logs: Application access logs showing authenticated requests from session tokens belonging to accounts that no longer exist in the user database; backend audit logs (if enabled in v0.31.0.0+) showing activity from deleted user IDs.
• Database: Discrepancy between active session records in the session store and existing user accounts in the users table — sessions referencing non-existent user IDs indicate exploitation.
• Network: Continued authenticated HTTP requests (with valid session cookies) to protected endpoints from IP addresses associated with a deleted account's last known login.
• Application Behavior: Admin-initiated account deletions that do not result in immediate session termination for the affected user, observable via concurrent session monitoring tools (GitHub Advisory).

Upgrade CI4MS to version 0.31.0.0 or later, which integrates CodeIgniter Shield for authentication and resolves the session invalidation flaw (CI4MS Release). As an interim measure, administrators should manually identify and terminate active sessions for any deleted user accounts in the session store. Additionally, implement server-side account status validation on every authenticated request (not only at login) and enforce a maximum session lifetime policy. Back up the database and run composer update before upgrading, as version 0.31.0.0 includes major structural changes including Shield migration (GitHub Advisory).

The vulnerability was discussed briefly on Mastodon/Infosec.exchange and Bluesky shortly after disclosure, primarily as automated CVE notification posts. No significant vendor statements beyond the GitHub Security Advisory or notable independent researcher commentary have been identified. Coverage has been limited to automated vulnerability aggregators such as VulnDB, CVEFeed, and ENISA's EUVD (GitHub Advisory).