What is CVE-2026-25509?

CVE-2026-25509 is a medium-severity vulnerability in Ci4-Cms-Erp Ci4ms, classified under Observable Response Discrepancy. CVSS score: 5.3/10. Published 2026-02-03.

How severe is CVE-2026-25509?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Ci4-Cms-Erp Ci4ms

CVE-2026-25509

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.28.5.0, the authentication implementation in CI4MS is vulnerable to email enumeration. An unauthenticated attacker can determine whether an email address is registered in the system by analyzing the application's response during the password reset process. This issue has been patched in version 0.28.5.0.

EPSS: 0.003 (27.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Ci4-cms-erp Ci4ms — versions < 0.28.5.0

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2026-25509?: CVE-2026-25509 is a medium-severity vulnerability in Ci4-Cms-Erp Ci4ms, classified under Observable Response Discrepancy. CVSS score: 5.3/10. Published 2026-02-03.
How severe is CVE-2026-25509?: Medium severity. CVSS v3 base score is 5.3 out of 10.