CI4MS, a CodeIgniter 4-based CMS skeleton, has a logic flaw that prevents the immediate revocation of active user sessions when an account is deactivated. The application only updates account state during authentication, not for established sessions, meaning that deactivated accounts retain full access until users manually log out. This flaw results in persistent unauthorized access across all user roles, violating the intended RBAC access control policy and exposing the system to critical compromise.

The vulnerability affects the CI4MS application from the vendor ci4-cms-erp. All installations of CI4MS versions prior to 0.31.0.0 are impacted, regardless of deployment environment, as the session invalidation logic is baked into the core module.

The CVSS score of 8.8 indicates a high severity, but the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers who already possess a valid session can exploit the flaw by keeping that session alive even after deactivation, achieving unauthorized continued access. The absence of a session expiration or account expiration mechanism makes this a straightforward privilege escalation scenario for any entity that can trigger account deactivation.