CVE-2026-34570: Broken Access Control in ci4-cms-erp

The core impact of CVE-2026-34570 is the potential for session hijacking. An attacker who has previously interacted with a legitimate user account can delete that account, and if the session is not properly invalidated, the attacker can continue to use the existing session token to impersonate the deleted user. This allows them to perform actions with the privileges associated with that user, potentially gaining access to sensitive data or performing administrative functions. The blast radius is directly tied to the privileges of the compromised user account; an attacker gaining access to an administrator account could compromise the entire system. This vulnerability highlights a critical failure in access control logic, where the system incorrectly assumes that authenticated users remain trustworthy even after their accounts are removed.

1. Reserved2026-03-30
2. Published2026-04-01
3. Modified2026-04-06
4. EPSS updated2026-04-09

The primary mitigation for CVE-2026-34570 is to upgrade to version 0.31.0.0 of ci4-cms-erp, which contains the fix for this broken access control issue. If immediate upgrading is not feasible, consider implementing temporary workarounds. Review and strengthen account deletion processes to ensure all session tokens are immediately revoked. Implement stricter session timeout policies to limit the window of opportunity for attackers. Consider using a Web Application Firewall (WAF) with rules to detect and block suspicious session activity, particularly related to account deletion events. Monitor system logs for unusual login patterns or account deletion activity that could indicate exploitation.

Last updated

0.31.9recently