CVE-2026-41891: CI4MS has a Deactivated User Session Bypass (active=0)

May 4, 2026 (updated May 8, 2026)

The auth filter has the deactivated/banned user check commented out.

References

github.com/advisories/GHSA-5hfv-c864-qcq9
github.com/ci4-cms-erp/ci4ms/commit/2f38284281ce6b435ea42003951f14109ac2cea7
github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.8.0
github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-5hfv-c864-qcq9
nvd.nist.gov/vuln/detail/CVE-2026-41891

Code Behaviors & Features

Detect and mitigate CVE-2026-41891 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →