PT-2026-37160 · Ci4Ms · Ci4Ms

Dapickle · Published 2026-05-04 · Updated 2026-05-07 · CVE-2026-41890

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions CI4MS versions 0.31.1.0 through 0.31.7.0

Description The deleteProcess() function in the /backend/themes/delete-process/{slug} endpoint fails to validate the tables[] POST parameter. An authenticated administrator can send a crafted request containing arbitrary table names, which are passed directly to the $forge->dropTable() function. This allows the user to delete any table within the database, regardless of whether it belongs to the theme being deleted. This flaw can lead to the loss of critical data, such as user identities and authentication tables, effectively disabling system access.

Recommendations Update to version 0.31.8.0. As a temporary workaround, restrict access to the deleteProcess() function to only the most trusted administrators until the update is applied.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-41890

GHSA-VGRF-PR28-VF98

Affected Products

Ci4Ms

References · 10

• 🔥 https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-vgrf-pr28-vf98 · Exploit
• https://osv.dev/vulnerability/GHSA-vgrf-pr28-vf98 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41890 · Security Note
• https://github.com/ci4-cms-erp/ci4ms · Note
• https://github.com/ci4-cms-erp/ci4ms/commit/2f38284281ce6b435ea42003951f14109ac2cea7 · Note
• https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.8.0 · Note
• https://t.me/CVEtracker/52938 · Telegram Post
• https://twitter.com/CVEarity/status/2052429337417445887 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2052281839289606435 · Twitter Post
• https://twitter.com/CVEnew/status/2052400832159916165 · Twitter Post