CVE-2026-39393 - Vulnerability Analysis

Overview

CI4MS < 0.31.4.0 contains a broken access control vulnerability caused by reliance on volatile cache and .env file existence in the install route guard, letting unauthenticated attackers overwrite .env and take over the application, exploit requires database unavailability during cache miss.

Severity & Score

Impact

Unauthenticated attackers can overwrite configuration files and take full control of the application.

Mitigation

Update to version 0.31.4.0 or later.

References

• https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-8rh5-4mvx-xj7j

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner