CVE-2026-39389 CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files

What is CVE-2026-39389?

CVE-2026-39389 is a medium-severity missing authorization vulnerability in ci4-cms-erp ci4ms, published on 8 Apr 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, This vulnerability is fixed in 0.31.4.0.

Weakness: CWE-285

Which versions are affected by CVE-2026-39389?

2 open source packages ship an affected version, including ci4-cms-erp/ci4ms. It affects 1 product.

Products include Ci4-Cms-Erp Ci4ms.

How do I fix CVE-2026-39389?

Upgrade ci4-cms-erp/ci4ms to 0.31.4.0 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-39389 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-39389 exists.

Other vulnerabilities in ci4-cms-erp ci4ms

• CVE-2026-34569 CI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS Critical 10.0
• CVE-2026-34571 CI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account Compromise Critical 10.0
• CVE-2026-25510 CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor Critical 10.0
• CVE-2026-34989 CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS Critical 9.4
• CVE-2026-34559 CI4MS: Blogs Tags Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9rxp-f27p-wv3h.