CVE-2026-25509

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.28.5.0, the authentication implementation in CI4MS is vulnerable to email enumeration. An unauthenticated attacker can determine whether an email address is registered in the system by analyzing the application's response during the password reset process. This issue has been patched in version 0.28.5.0.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/ci4-cms-erp/ci4ms/commit/86be2930d1c54eb7575102563302b2f3bafcb653	Patch
https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-654x-9q7r-g966	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ci4-cms-erp:ci4ms:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-02-03 22:16

Updated : 2026-02-10 18:41

NVD link : CVE-2026-25509

Mitre link : CVE-2026-25509

CVE.ORG link : CVE-2026-25509

JSON object : View

Products Affected

ci4-cms-erp

ci4ms

CWE

CWE-204

Observable Response Discrepancy

CWE-203

Observable Discrepancy

{"id": "CVE-2026-25509", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2026-02-03T22:16:31.433", "references": [{"url": "https://github.com/ci4-cms-erp/ci4ms/commit/86be2930d1c54eb7575102563302b2f3bafcb653", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-654x-9q7r-g966", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-204"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-203"}]}], "descriptions": [{"lang": "en", "value": "CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.28.5.0, the authentication implementation in CI4MS is vulnerable to email enumeration. An unauthenticated attacker can determine whether an email address is registered in the system by analyzing the application's response during the password reset process. This issue has been patched in version 0.28.5.0."}, {"lang": "es", "value": "CI4MS es un esqueleto de CMS basado en CodeIgniter 4 que ofrece una arquitectura modular, lista para producci\u00f3n, con autorizaci\u00f3n RBAC y soporte de temas. Antes de la versi\u00f3n 0.28.5.0, la implementaci\u00f3n de autenticaci\u00f3n en CI4MS es vulnerable a la enumeraci\u00f3n de correos electr\u00f3nicos. Un atacante no autenticado puede determinar si una direcci\u00f3n de correo electr\u00f3nico est\u00e1 registrada en el sistema analizando la respuesta de la aplicaci\u00f3n durante el proceso de restablecimiento de contrase\u00f1a. Este problema ha sido parcheado en la versi\u00f3n 0.28.5.0."}], "lastModified": "2026-02-10T18:41:26.530", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ci4-cms-erp:ci4ms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AF5BFA71-5A9A-4ADF-ACD4-5E3B6FAB1DBE", "versionEndExcluding": "0.28.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}