PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-39391 ci4-cms-erp CVE debrief

CVE-2026-39391 is a stored cross-site scripting vulnerability in CI4MS, a CodeIgniter 4-based CMS skeleton. Prior to version 0.31.4.0, the blacklist note parameter is stored in the database without sanitization and rendered into an HTML data-note attribute without escaping. An admin with blacklist privileges can inject arbitrary JavaScript that executes in the browser of any other admin who views the user management page. The vulnerability is fixed in version 0.31.4.0.

Vendor
ci4-cms-erp
Product
ci4ms
CVSS
MEDIUM 4.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-08
Original CVE updated
2026-07-20
Advisory published
2026-04-08
Advisory updated
2026-07-20

Who should care

Administrators and users of CI4MS, a CodeIgniter 4-based CMS skeleton, should be aware of this vulnerability and take steps to mitigate it. This vulnerability requires admin privileges to exploit, but can impact any admin who views the user management page.

Technical summary

The vulnerability exists in the UserController::ajax_blackList_post() method of CI4MS, a CodeIgniter 4-based CMS skeleton. The blacklist note parameter is not sanitized or escaped, allowing an admin with blacklist privileges to inject arbitrary JavaScript. This JavaScript can execute in the browser of any other admin who views the user management page. The vulnerability is fixed in version 0.31.4.0. Affected product deployments should be identified and owners assigned for follow-up. The impact of this vulnerability is medium, and administrators should review compensating controls for exposed systems while remediation is scheduled and verified.

Defensive priority

Medium

Recommended defensive actions

  • Update CI4MS to version 0.31.4.0 or later
  • Restrict access to the user management page to authorized administrators only
  • Implement additional security measures, such as input validation and output encoding
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-04-08T15:16:13.897Z and last modified on 2026-07-20T20:10:00.110Z. The NVD entry is currently Analyzed. This information is based on the provided source corpus. Further verification by defenders is recommended to ensure accuracy and completeness of the information.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-39391 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-39391

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-39391 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-39391

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.