{"answers":{"affected":"2 open source packages ship an affected version, including ci4-cms-erp/ci4ms.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41890 exists.","fix":"Upgrade ci4-cms-erp/ci4ms to 0.31.8.0 or later.","what":"CVE-2026-41890 is a medium-severity missing authorization vulnerability in ci4-cms-erp ci4ms, published on 7 May 2026. An attacker needs administrator access to exploit it, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-41890 and fix it if it is affected.\n\nWhat it is: CVE-2026-41890 is a medium-severity missing authorization vulnerability in ci4-cms-erp ci4ms, published on 7 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41890 exists.\n\nAffected packages and fixed versions:\n- ci4-cms-erp/ci4ms (Packagist): affected from 0.31.1.0; fixed in 0.31.8.0\n- ci4-cms-erp/ci4ms (Packagist): affected from 0.31.1.0; fixed in 0.31.8.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-41890/ (Markdown: https://insights.sbomify.com/CVE-2026-41890/index.md)","id":"CVE-2026-41890","markdown":"https://insights.sbomify.com/CVE-2026-41890/index.md","name":"CVE-2026-41890","record":{"aliases":["GHSA-vgrf-pr28-vf98"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["data_modify"],"network_reachable":"yes","non_default_config":false,"product_category":"CodeIgniter CMS skeleton","requires_auth":"high_privilege","summary":"An authenticated admin can drop arbitrary database tables by bypassing server-side validation in the theme deletion process.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":6.9,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"description":"CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. From version 0.31.1.0 to before version 0.31.8.0, the deleteProcess() action accepts a POST parameter tables[] containing arbitrary table names. These are passed directly to $forge-\u003edropTable() without validating that the tables belong to the theme being deleted. The deleteConfirm view correctly populates tables[] from the theme's own migration files, but the server-side deleteProcess does not verify the received values against those files. An authenticated admin can craft a POST request with arbitrary table names and drop any table in the database. This issue has been patched in version 0.31.8.0.","ecosystems":["Packagist"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"CI4MS: Arbitrary Database Table Drop via Theme deleteProcess","id":"CVE-2026-41890","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"missing_authorization","year":"2026"},"n_packages":2,"n_references":2,"next":{"headline":"CI4MS: Deactivated User Session Bypass (active=0)","id":"CVE-2026-41891"},"packages":[{"ecosystem":"Packagist","fixed":["0.31.8.0"],"introduced":["0.31.1.0"],"last_affected":[],"package":"ci4-cms-erp/ci4ms","purl":null,"source":"GHSA-vgrf-pr28-vf98"},{"ecosystem":"Packagist","fixed":["0.31.8.0"],"introduced":["0.31.1.0"],"last_affected":[],"package":"ci4-cms-erp/ci4ms","purl":"pkg:composer/ci4-cms-erp/ci4ms","source":"GHSA-vgrf-pr28-vf98"}],"prev":{"headline":"pgx: SQL Injection via placeholder confusion with dollar quoted string literals","id":"CVE-2026-41889"},"products":["ci4ms"],"published":"2026-05-07","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-05-07","vendors":["ci4-cms-erp"]},"summary":"An authenticated admin can drop arbitrary database tables by bypassing server-side validation in the theme deletion process.","url":"https://insights.sbomify.com/CVE-2026-41890/"}