A critical access control vulnerability in CI4MS allows deactivated user accounts to retain unauthorized access to the system, posing a significant risk of data compromise and privilege abuse.

This is an improper access control and insufficient session expiration flaw where account state changes are only validated during initial authentication, failing to invalidate established sessions for deactivated users. The vulnerability requires the attacker to be a previously authorized user whose account has since been revoked.

The ability for deactivated users to maintain access circumvents organizational security policies regarding offboarding and identity management. This flaw could lead to unauthorized data exposure, potential modification of sensitive records, and prolonged access by terminated employees or compromised accounts, justifying the high CVSS score of 8.8.

Immediate Action: Upgrade the CI4MS application to version 0.31.0.0 or later to implement the corrected session validation logic.

Proactive Monitoring: Review application access logs for activity associated with accounts that are known to be deactivated or disabled.

Compensating Controls: If an immediate update is not feasible, administrators should manually flush or terminate active sessions via the database or cache layer whenever an account is deactivated.

Public Exploit Available: Unknown

Given the potential for unauthorized access by revoked users, organizations utilizing CI4MS must prioritize this update. Applying the fix in version 0.31.0.0 is the only reliable way to ensure that account deactivation is effectively enforced across all active sessions.