https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 10:47:01 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-308950 EUVD-2026-308950 https://cve.radiocsirt.org/vuln/euvd-2026-308950 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41891 <p>CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. From version 0.26.0 to before version 0.31.8.0, the auth filter has the deactivated/banned user check commented out. This issue has been patched in version 0.31.8.0.</p> <p>CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. From version 0.26.0 to before version 0.31.8.0, the auth filter has the deactivated/banned user check commented out. This issue has been patched in version 0.31.8.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41891 https://cve.radiocsirt.org/vuln/ghsa-5hfv-c864-qcq9 <p><strong>Affected:</strong> Packagist: ci4-cms-erp/ci4ms</p> <p>### Summary The auth filter has the deactivated/banned user check commented out.</p> <p>### Details CodeIgniter Shield&#39;s `loggedIn()` re-checks the `status` field (catching `status=&#39;banned&#39;`), but does **not** re-check the `active` field for existing sessions. When an admin deactivates a user (`active=0`) after they have already logged in: - Their session cookie remains valid - `auth()-&gt;loggedIn()` still returns `true` - The commented-out code is the only mechanism that would have checked `!$user-&gt;active`</p> <p>### Evidence &lt;img width=&#34;981&#34; height=&#34;654&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/6f75d144-5bcf-4a3f-bc35-bb0715c3ed05&#34; /&gt;</p> <p>### Impact - User deactivation does NOT immediately revoke backend access - Deactivated user retains full access until session expires (default: 7200s)</p> <p>### Additional note The commented-out block appears to be a deferred placeholder — it was written but disabled from the very first commit that introduced the filter, and has never been active. The later addition of SessionTracker (v0.31.4.0) suggests the dev was aware of the session revocation gap, but account-level deactivation (users.active = 0) remains unenforced. Could you verify if this is intentionally pending or simply forgotten and not documented?.</p> <p><strong>Affected:</strong> Packagist: ci4-cms-erp/ci4ms</p> <p>### Summary The auth filter has the deactivated/banned user check commented out.</p> <p>### Details CodeIgniter Shield&#39;s `loggedIn()` re-checks the `status` field (catching `status=&#39;banned&#39;`), but does **not** re-check the `active` field for existing sessions. When an admin deactivates a user (`active=0`) after they have already logged in: - Their session cookie remains valid - `auth()-&gt;loggedIn()` still returns `true` - The commented-out code is the only mechanism that would have checked `!$user-&gt;active`</p> <p>### Evidence &lt;img width=&#34;981&#34; height=&#34;654&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/6f75d144-5bcf-4a3f-bc35-bb0715c3ed05&#34; /&gt;</p> <p>### Impact - User deactivation does NOT immediately revoke backend access - Deactivated user retains full access until session expires (default: 7200s)</p> <p>### Additional note The commented-out block appears to be a deferred placeholder — it was written but disabled from the very first commit that introduced the filter, and has never been active. The later addition of SessionTracker (v0.31.4.0) suggests the dev was aware of the session revocation gap, but account-level deactivation (users.active = 0) remains unenforced. Could you verify if this is intentionally pending or simply forgotten and not documented?.</p> https://cve.radiocsirt.org/vuln/ghsa-5hfv-c864-qcq9