Skip to content
OpenAdvisories
Medium · 6.7 CVE-2026-39389 EUVD-2026-20481GHSA-9rxp-f27p-wv3h

CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files

Published Apr 8, 2026 · Updated Apr 10, 2026 · Assigned by GitHub_M

Description

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, This vulnerability is fixed in 0.31.4.0.

Affected products

VendorProductAffectedFixed
ci4-cms-erp ci4ms < 0.31.4.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist ci4-cms-erp/ci4ms < 0.31.4.0 0.31.4.0 GHSA-9rxp-f27p-wv3h

References