Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2026-25509: CI4MS password reset reveals registered emails
CVE-2026-25509 · published 9 months ago
Summary
The CI4MS content system lets anyone check if an email address is in its user list during the password reset process. This can help attackers target known users. Upgrade to version 0.28.5.0 or later to stop the email lookup.
What to do
- Update ci4-cms-erp ci4ms to version 0.28.5.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| ci4-cms-erp | ci4ms |
< 0.28.5.0 cpe:2.3:a:ci4-cms-erp:ci4ms:*:*:*:*:*:*:*:* |
Original advisory text
CI4MS Vulnerable to User Email Enumeration via Password Reset Flow
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.28.5.0, the authentication implementation in CI4MS is vulnerable to email enumeration. An unauthenticated attacker can determine whether an email address is registered in the system by analyzing the application's response during the password reset process. This issue has been patched in version 0.28.5.0.
References
- https://github.com/advisories/GHSA-654x-9q7r-g966
- https://nvd.nist.gov/vuln/detail/CVE-2026-25509 Vendor Advisory
- https://github.com/ci4-cms-erp/ci4ms/commit/86be2930d1c54eb7575102563302b2f3bafc... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25509... Vendor Advisory
- https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-654x-9q7r-g966 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-204Observable Response Discrepancy
CWE-203Observable Discrepancy
Timeline
Published3 Feb 2026
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta