CodeIgniter 4-based CMS Vulnerability in CI4MS by CI4-CMS

CVE-2026-39393

What is CVE-2026-39393?

The CI4MS application, a modular CMS built on CodeIgniter 4, suffers from a vulnerability that allows unauthenticated attackers to bypass post-installation security measures. This occurs due to faulty reliance on a volatile cache to control access to the setup wizard. If the database becomes temporarily inaccessible during a cache miss, the security guard fails, granting attackers the ability to overwrite critical configuration files with malicious database credentials. This flaw puts the entire application at risk, enabling full control to malicious actors. The vulnerability has been addressed in version 0.31.4.0.

References