Executive brief
CI4MS has a Deactivated User Session Bypass (active=0)
Affected products
- Packagist ci4-cms-erp/ci4ms
Junglewise Threat Intelligence
CVE-2026-41891: CI4MS has a Deactivated User Session Bypass (active=0)
CVE-2026-41891 · Severity: medium · CVSS 4 · Published 2026-05-04
Technologies: ci4-cms-erp/ci4ms (Packagist). Vendors: Packagist.
Related threats
- ci4-cms-erp CI4MS stored XSS in Pages module
- ci4-cms-erp CI4MS file deletion and rename in Fileeditor module
- ci4-cms-erp ci4ms stored XSS in Blog and Pages content
- CI4MS Vulnerable to Arbitrary Database Table Drop via Theme deleteProcess
- CI4MS has Unrestricted PHP File Upload via Theme Installation that Leads to Authenticated Remote Code Execution