CVE-2026-34572: 
PHP vulnerability analysis and mitigation

CVE-2026-34572 is an improper session invalidation vulnerability in CI4MS, a CodeIgniter 4-based CMS skeleton with RBAC authorization and theme support. The flaw allows deactivated user accounts to retain indefinite, unauthorized access to the application because active sessions are not revoked upon account deactivation. All versions up to and including 0.28.6.0 (prior to 0.31.0.0) are affected. The vulnerability was published on April 1, 2026, and carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory).

The root cause is a logic flaw in the backend session management, classified under CWE-284 (Improper Access Control), CWE-613 (Insufficient Session Expiration), and CWE-1254 (Incorrect Comparison Logic Granularity). Account state changes — specifically deactivation — are only evaluated at authentication time (login), meaning already-established sessions are never checked against the current account status. The system implicitly trusts authenticated sessions for their entire lifetime, with no session expiration or account expiration mechanism to force re-validation. An attacker (or a user whose account has been administratively deactivated) can exploit this by simply continuing to use their existing session token, bypassing the intended access revocation (GitHub Advisory).

A deactivated user retains full access to the CI4MS application — including read access to sensitive data, the ability to modify system information, and potential disruption of service availability — for as long as their session remains active. Since there is no automatic session expiration tied to account state, access can persist indefinitely until the user manually logs out or the session naturally expires. This breaks the intended RBAC access control policy and could allow terminated employees, compromised accounts, or otherwise revoked users to continue operating within the system (GitHub Advisory, Feedly).

No confirmed in-the-wild exploitation or weaponized exploit code has been identified. The GitHub Security Advisory includes generic reproduction steps (create/use an account, log in, deactivate the account, and observe continued access) but no specific payloads or exploit code (GitHub Advisory). The EPSS score is approximately 0.083%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Obtain a valid account: Use an existing low-privilege user account on a CI4MS instance running version ≤ 0.28.6.0.
2. Authenticate and establish a session: Log into the CI4MS application normally, obtaining a valid session cookie.
3. Trigger account deactivation: Have an administrator deactivate the user account through the CI4MS admin panel (or simulate this scenario if testing your own deployment).
4. Continue using the active session: Without logging out, continue making authenticated requests to the application using the existing session cookie — the application will not re-validate account status against the session.
5. Maintain persistent access: Since no session invalidation occurs server-side upon deactivation, the attacker retains full access to all resources and actions permitted by their role until they manually log out or the session naturally expires (GitHub Advisory).

• Logs: Authentication logs showing no new login events for a user account after its deactivation date, yet continued backend activity (page requests, data modifications) under that account's session.
• Application Logs: CI4MS backend access logs (enhanced in v0.31.0.0 via the Audit Trail/BackendLogFilter) recording actions by user accounts that are marked as inactive/deactivated in the user management database.
• Network: Authenticated HTTP requests carrying session cookies associated with deactivated accounts, identifiable by cross-referencing active session tokens against the account status table in the database.
• Database: Discrepancy between a user's status = deactivated flag in the users table and ongoing session records in the sessions table for that user (GitHub Advisory, CI4MS Release).

Upgrade CI4MS to version 0.31.0.0 or later, which replaces the custom authentication system with CodeIgniter Shield and introduces proper session management, audit logging, and account state enforcement (CI4MS Release). As an interim workaround prior to upgrading, administrators should manually terminate active sessions for any deactivated accounts — for example, by clearing session records from the database or session storage for the affected user. It is also recommended to back up the database and run composer update before upgrading, given the major structural changes in v0.31.0.0 (GitHub Advisory).

The vulnerability received limited but notable coverage across security aggregation platforms and social media. The Hacker Wire published an article on the issue, and it was shared on Mastodon by the same outlet (Mastodon). The advisory was also picked up by automated CVE tracking services including VulDB, CIRCL, and INCIBE-CERT. No major vendor statements or prominent independent researcher commentary beyond the original advisory reporter (bugmithlegend) have been identified (GitHub Advisory).