CVE-2026-39393: CI4MS Vulnerable to Post-Installation Re-entry via Cache-Dependent Install Guard Bypass

April 8, 2026

The install route guard in ci4ms relies solely on a volatile cache check (cache('settings')) combined with .env file existence to block post-installation access to the setup wizard. When the database is temporarily unreachable during a cache miss (TTL expiry or admin-triggered cache clear), the guard fails open, allowing an unauthenticated attacker to overwrite the .env file with attacker-controlled database credentials, achieving full application takeover.

References

github.com/advisories/GHSA-8rh5-4mvx-xj7j
github.com/ci4-cms-erp/ci4ms
github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.4.0
github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-8rh5-4mvx-xj7j
nvd.nist.gov/vuln/detail/CVE-2026-39393

Code Behaviors & Features

Detect and mitigate CVE-2026-39393 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →