dbcve.org
Improper Input ValidationWeakness · CWE-20

CVE-2026-41890

MEDIUM · 6.9 CVSS v4.0 Published 2026-05-07
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
75/100
Remediation priority · High
Remotely reachable Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. From version 0.31.1.0 to before version 0.31.8.0, the deleteProcess() action accepts a POST parameter tables[] containing arbitrary table names. These are passed directly to $forge->dropTable() without validating that the tables belong to the theme being deleted. The deleteConfirm view correctly populates tables[] from the theme's own migration files, but the server-side deleteProcess does not verify the received values against those files. An authenticated admin can craft a POST request with arbitrary table names and drop any table in the database. This issue has been patched in version 0.31.8.0.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

CI4MS CMS has an Insecure Direct Object Reference (IDOR) vulnerability in the deleteProcess() action. The action accepts a POST parameter tables[] containing arbitrary table names and passes them directly to CodeIgniter's $forge->dropTable() without validating that the tables belong to the theme being deleted. An authenticated admin can craft a POST request to drop any table in the database.

MitigationUpgrade to version 0.31.8.0 or later, which includes server-side validation that verifies table names against the theme's migration files before allowing deletion.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
High
Authentication
X
User interaction
None
Scope
X

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify CI4MS CMS installation and version
    Check for CI4MS CMS files and look for a version identifier in composer.json, a config file, or a version constant. Common locations include the root directory or an app/config/ folder.
    Affected if The installed version is below 0.31.8.0 or the version cannot be determined (older installation).
  2. Locate the deleteProcess() action
    Search the codebase for the deleteProcess function, typically in a controller related to theme management or migrations. Look for files handling theme deletion operations.
    Affected if The deleteProcess() function exists and accepts a tables[] parameter without validation.
  3. Verify table name validation is missing
    Examine the deleteProcess() function code. Look for whether the tables[] array is validated against theme migration files before being passed to $forge->dropTable(). Search for any whitelist check or theme ownership verification.
    Affected if The code directly passes the tables[] parameter to $forge->dropTable() without validating that the tables belong to the theme being deleted.
  4. Confirm admin authentication is required
    Verify that the vulnerable endpoint requires admin-level authentication. Check if there is any session or role-based access control on the deleteProcess() action.
    Affected if The endpoint requires admin authentication but does not enforce table ownership validation.
  5. Check database user privileges
    Review the database configuration to determine what tables the application user can drop. Check if the database user has privileges to drop tables outside the expected theme scope.
    Affected if The database user has broad table drop privileges beyond the theme management scope.

A user is affected if they are running CI4MS CMS version below 0.31.8.0 and the deleteProcess() action accepts unvalidated tables[] parameters that can drop arbitrary database tables.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Upgrade to version 0.31.8.0 or later, which includes server-side validation that verifies table names against the theme's migration files before allowing deletion.

Recommended fix High confidence

version 0.31.8.0

  1. Upgrade CI4MS to version 0.31.8.0 to obtain the patched code that validates table names against theme migration files before dropping tables
  2. After upgrading, verify that the deleteProcess() action now properly validates that tables belong to the theme being deleted before executing dropTable()

Generated from the published advisory — verify against the referenced sources before acting.

Have this fixed Scoped from the published advisory
  • Consultation2.0 h
  • Implementation4.0 h
  • Testing3.0 h
  • Review / QA2.0 h
11.0 hours of engineering $1,930
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,088.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-41890 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-41890 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data