5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25509

CVE-2026-25509: CI4MS Vulnerable to User Email Enumeration via Password Reset Flow

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.28.5.0, the authentication implementation in CI4MS is vulnerable to email enumeration. An unauthenticated attacker can determine whether an email address is registered in the system by analyzing the application's response during the password reset process. This issue has been patched in version 0.28.5.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25509

CVE-2026-25509:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ci4-cms-erp/ci4ms	composer	< 0.28.5.0	0.28.5.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security vulnerability is an email enumeration issue within the password reset functionality of the CI4MS application. By analyzing the provided patch, the root cause was identified in the forgotPassword method of the AuthController. The original code returned a specific error message when a user was not found, which differed from the message returned when a user was found. This discrepancy allowed an attacker to confirm the existence of user accounts. The patch addresses this by ensuring the same generic message is returned in both scenarios, effectively removing the information leak. Therefore, the forgotPassword function is the key vulnerable function that would be active during exploitation of this vulnerability.

Vulnerable functions

Modules\Auth\Controllers\AuthController::forgotPassword

modules/Auth/Controllers/AuthController.php

The `forgotPassword` function in `AuthController.php` was vulnerable to user enumeration. It returned a distinct error message (`Auth.forgotNoUser`) when an email address was not found in the database. This allowed an attacker to determine which email addresses were registered with the application by observing the different responses. The patch mitigates this by returning a generic message (`Auth.forgotEmailSent`) regardless of whether the user exists, making it impossible to distinguish between registered and unregistered users.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.