A flaw in CI4MS’s authentication logic allows an attacker with no credentials to discover whether a given email address is registered in the system by observing differing responses during the password‑reset flow. The vulnerability exposes user identities, thereby providing valuable information for targeted phishing or social‑engineering attacks without granting any additional system privileges.

All installations of CI4MS earlier than version 0.28.5.0 run the vulnerable code. The affected product is the CI4MS CMS skeleton from the vendor ci4‑cms‑erp. No specific sub‑versions are listed beyond that cut‑off, so any release before 0.28.5.0 is considered impacted.

The CVSS score of 5.3 places the flaw in the moderate range, and the EPSS score of less than 1% indicates a very low probability of exploitation at the time of analysis. The defect is not listed in CISA’s Known Exploited Vulnerabilities catalog. A likely exploitation path is a web‑based request to the password‑reset endpoint, which a remote attacker can repeatedly query with arbitrary email addresses to see whether the application returns a success or error message. No authentication or privileged context is required to carry out the enumeration.