CVE-2026-39391: CI4MS has stored XSS via Unescaped `Blacklist` Note in Admin User List

April 8, 2026

The blacklist (ban) note parameter in UserController::ajax_blackList_post() is stored in the database without sanitization and rendered into an HTML data-note attribute without escaping. An admin with blacklist privileges can inject arbitrary JavaScript that executes in the browser of any other admin who views the user management page.

References

github.com/advisories/GHSA-7cm9-v848-cfh2
github.com/ci4-cms-erp/ci4ms
github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.4.0
github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-7cm9-v848-cfh2
nvd.nist.gov/vuln/detail/CVE-2026-39391

Code Behaviors & Features

Detect and mitigate CVE-2026-39391 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →