EUVD-2026-20481
GHSA-9rxp-f27p-wv3h
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, This vulnerability is fixed in 0.31.4.0.
AnalysisAI
CI4MS (CodeIgniter 4 CMS) versions prior to 0.31.4.0 contain an authentication bypass vulnerability (CWE-285) that allows high-privileged users to escalate or circumvent authorization controls. The vulnerability affects the role-based access control (RBAC) system in CI4MS, enabling authenticated administrators to gain unauthorized access to protected resources or functions. With a CVSS score of 6.7 and EPSS exploitation probability indicating moderate real-world risk, this requires immediate patching in production deployments.
Technical ContextAI
CI4MS is a modular CMS framework built on CodeIgniter 4, which provides RBAC authorization mechanisms for controlling user access to resources based on assigned roles and permissions. CWE-285 (Improper Authorization) indicates a flaw in the authorization logic that inadequately validates user permissions or role assignments. The vulnerability likely exists in CI4MS's permission checking layer, potentially allowing high-privileged authenticated users (PR:H in CVSS vector) to bypass role-based restrictions through improper validation of authorization tokens, session context, or permission inheritance. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U) indicates this is a network-accessible flaw that requires high privilege but no user interaction, suggesting the attack occurs entirely at the application level during authenticated sessions.
RemediationAI
Vendor-released patch: upgrade CI4MS to version 0.31.4.0 or later immediately. This version includes fixes to the RBAC authorization logic that remediate CWE-285. For organizations unable to patch immediately, restrict administrative access to trusted personnel only and implement additional network-level controls (IP whitelisting, WAF rules) to limit exposure of the administrative interface. Refer to the GitHub Security Advisory (https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-9rxp-f27p-wv3h) for detailed patch release notes and validation steps.
CI4MS (CodeIgniter 4 CMS skeleton) has a code injection vulnerability (CVSS 9.9) allowing authenticated users to execute
Stored cross-site scripting in CI4MS backend user management allows authenticated attackers with low-level privileges to
Stored cross-site scripting in CI4MS blog category management allows authenticated users to inject malicious JavaScript
Environment file injection in CI4MS versions prior to 0.31.4.0 allows remote attackers to inject arbitrary configuration
Stored cross-site scripting in CI4MS blog module allows authenticated attackers to inject malicious JavaScript that exec
Stored cross-site scripting in CI4MS (CodeIgniter 4 CMS) allows authenticated users with blog post management privileges
Stored cross-site scripting (XSS) in CI4MS page management functionality allows authenticated attackers to inject malici
Stored cross-site scripting (XSS) in CI4MS menu management allows authenticated users with low privileges to inject mali
Stored cross-site scripting in CI4MS menu management allows authenticated attackers to inject malicious scripts that exe
Stored blind cross-site scripting in CI4MS backup management allows authenticated attackers to inject malicious JavaScri
Stored Cross-Site Scripting in CI4MS methods management allows authenticated users to inject malicious JavaScript into a
Stored cross-site scripting in CI4MS role/group management allows authenticated attackers to inject malicious JavaScript
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today