CVE-2026-41891 CI4MS: Deactivated User Session Bypass (active=0)
Deactivated users can bypass authentication checks in CI4MS due to commented-out code, allowing unauthorized access to the system.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41891?
CVE-2026-41891 is a medium-severity authentication bypass vulnerability in ci4-cms-erp ci4ms, published on 7 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. From version 0.26.0 to before version 0.31.8.0, the auth filter has the deactivated/banned user check commented out. This issue has been patched in version 0.31.8.0.
Weakness: CWE-613
Which versions are affected by CVE-2026-41891?
2 open source packages ship an affected version, including ci4-cms-erp/ci4ms.
| Package | Affected | Fixed in |
|---|---|---|
ci4-cms-erp/ci4ms Packagist | From 0.26.0 | 0.31.8.0 |
ci4-cms-erp/ci4ms Packagist | From 0.26.0 | 0.31.8.0 |
How do I fix CVE-2026-41891?
Upgrade ci4-cms-erp/ci4ms to 0.31.8.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-41891 being exploited?
There is no known exploitation of CVE-2026-41891 in the wild and no public exploit code.
Sources
Also known as GHSA-5hfv-c864-qcq9.