GHSA-5hfv-c864-qcq9

Suggest an improvement
Source
https://github.com/advisories/GHSA-5hfv-c864-qcq9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-5hfv-c864-qcq9/GHSA-5hfv-c864-qcq9.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-5hfv-c864-qcq9
Aliases
Published
2026-05-04T20:50:55Z
Modified
2026-05-08T20:31:16Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
CI4MS has a Deactivated User Session Bypass (active=0)
Details

Summary

The auth filter has the deactivated/banned user check commented out.

Details

CodeIgniter Shield's loggedIn() re-checks the status field (catching status='banned'), but does not re-check the active field for existing sessions. When an admin deactivates a user (active=0) after they have already logged in:

  • Their session cookie remains valid
  • auth()->loggedIn() still returns true
  • The commented-out code is the only mechanism that would have checked !$user->active

Evidence

image

Impact

  • User deactivation does NOT immediately revoke backend access
  • Deactivated user retains full access until session expires (default: 7200s)

Additional note

The commented-out block appears to be a deferred placeholder — it was written but disabled from the very first commit that introduced the filter, and has never been active. The later addition of SessionTracker (v0.31.4.0) suggests the dev was aware of the session revocation gap, but account-level deactivation (users.active = 0) remains unenforced. Could you verify if this is intentionally pending or simply forgotten and not documented?.

Database specific 
{
    "cwe_ids":  [
        "CWE-613"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-04T20:50:55Z",
    "nvd_published_at":  "2026-05-07T04:16:33Z",
    "severity":  "MODERATE"
}
References

Affected packages

Packagist / ci4-cms-erp/ci4ms

Package

Name
ci4-cms-erp/ci4ms
Purl
pkg:composer/ci4-cms-erp/ci4ms

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.26.0
Fixed
0.31.8.0

Affected versions

0.*
0.26.0.0
0.26.1.0
0.26.2.0
0.26.3.0
0.26.3.1
0.26.3.2
0.26.3.3
0.26.3.4
0.27.0.0
0.28.0.0
0.28.3.0
0.28.4.0
0.28.5.0
0.28.6.0
0.31.0.0
0.31.1.0
0.31.2.0
0.31.3.0
0.31.4.0
0.31.5.0
0.31.6.0
0.31.7.0

Database specific

last_known_affected_version_range 
"<= 0.31.7.0"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-5hfv-c864-qcq9/GHSA-5hfv-c864-qcq9.json"