CVE-2026-39391 ci4-cms-erp CVE debrief

Who should care

Administrators and users of CI4MS, a CodeIgniter 4-based CMS skeleton, should be aware of this vulnerability and take steps to mitigate it. This vulnerability requires admin privileges to exploit, but can impact any admin who views the user management page.

Technical summary

The vulnerability exists in the UserController::ajax_blackList_post() method of CI4MS, a CodeIgniter 4-based CMS skeleton. The blacklist note parameter is not sanitized or escaped, allowing an admin with blacklist privileges to inject arbitrary JavaScript. This JavaScript can execute in the browser of any other admin who views the user management page. The vulnerability is fixed in version 0.31.4.0. Affected product deployments should be identified and owners assigned for follow-up. The impact of this vulnerability is medium, and administrators should review compensating controls for exposed systems while remediation is scheduled and verified.

Defensive priority

Medium

Recommended defensive actions

• Update CI4MS to version 0.31.4.0 or later
• Restrict access to the user management page to authorized administrators only
• Implement additional security measures, such as input validation and output encoding
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-04-08T15:16:13.897Z and last modified on 2026-07-20T20:10:00.110Z. The NVD entry is currently Analyzed. This information is based on the provided source corpus. Further verification by defenders is recommended to ensure accuracy and completeness of the information.

Official resources