CI4MS, a CodeIgniter 4-based content management system, contains a logic flaw that causes deleted accounts to retain their authenticated sessions indefinitely. The flaw lies in the backend design, which only enforces account state changes during the authentication phase and not for sessions that are already active. As a result, when an account is marked as deleted, the system continues to trust the user until they manually log out. This leads to persistent unauthorized access across all roles assigned to the account, undermining the intended role‑based access control model.

The vulnerability affects the CI4MS product from CI4‑CMS‑ERP. All releases prior to version 0.31.0.0 are vulnerable. The flaw was addressed and patched in the 0.31.0.0 release.

The CVSS score of 8.8 indicates high severity, while the EPSS score of fewer than 1 % points to a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an attacker gaining access to the administrative interface to delete an account or manipulating the deletion API; this is inferred since the input does not explicitly state how the deletion action is performed. Once an account is flagged as deleted, any existing session remains active until the user explicitly logs out, allowing continuous access. The risk is therefore high if the attacker can delete an account or trigger the deletion mechanism, even though the likelihood of such an exploit is low given the current EPSS value.