CVE-2026-39389

Published: Apr 8, 2026Modified: Jul 24, 2026

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, This vulnerability is fixed in 0.31.4.0.

Affected (1)

Products: Ci4 Cms Erp: Ci4ms

Ci4 Cms Erp

1 product

Ci4ms

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Ci4 Cms Erp Ci4ms	Before 0.31.4.0

Related CWEs

CWE-285

Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

References (1)

https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-9rxp-f27p-wv3h

Source: security-advisories@github.com

ExploitVendor Advisory

Timeline

No history available yet.