CVE-2026-41890 Details
Description
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. From version 0.31.1.0 to before version 0.31.8.0, the deleteProcess() action accepts a POST parameter tables[] containing arbitrary table names. These are passed directly to $forge->dropTable() without validating that the tables belong to the theme being deleted. The deleteConfirm view correctly populates tables[] from the theme's own migration files, but the server-side deleteProcess does not verify the received values against those files. An authenticated admin can craft a POST request with arbitrary table names and drop any table in the database. This issue has been patched in version 0.31.8.0.
A vulnerability exists in CI4MS, a CodeIgniter 4-based CMS, in versions 0.31.1.0 prior to 0.31.8.0. The issue arises in the deleteProcess() action, which accepts a POST parameter 'tables[]' containing arbitrary table names. These names are passed directly to the database forge to drop tables, without validating whether the tables belong to the theme being deleted. This flaw allows an authenticated admin to delete any database table, undermining the integrity of the application's data management.
Users are advised to upgrade to CI4MS version 0.31.8.0, which addresses this vulnerability by implementing a migration-based whitelist that restricts table deletion to those belonging to the specific theme being managed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 7, 2026CISA-ADP
Assessed May 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-vgrf-pr28-vf98 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.8.0 | [email protected] | Release NotesVendor |
| https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-vgrf-pr28-vf98 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ci4-cms-erp ci4ms | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | New CVE Received | [email protected] |