The vulnerability in ci4ms versions >=0.26.0 and <0.31.8.0 involves the auth filter where the check for deactivated or banned users was disabled (commented out). This results in insufficient session expiration controls, potentially allowing unauthorized access if a user’s session remains active despite account status changes. The issue was fixed in version 0.31.8.0 by re-enabling the user status checks in the authentication filter.

The impact is that sessions for deactivated or banned users may not be properly invalidated, allowing continued access beyond intended session lifetimes. This could lead to unauthorized access if an attacker or a user with revoked privileges retains a valid session. However, the vulnerability does not allow privilege escalation or remote code execution directly and is rated medium severity.

Upgrade ci4ms to version 0.31.8.0 or later, where the issue has been patched by restoring the deactivated/banned user check in the authentication filter. No other specific mitigations are indicated. Patch status is confirmed by the vendor's versioning information.