CVE-2026-39391: CI4MS CodeIgniter CMS XSS Vulnerability

CVE-2026-39391 Overview

CVE-2026-39391 is a stored Cross-Site Scripting (XSS) vulnerability affecting CI4MS, a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.4.0, the blacklist (ban) note parameter in UserController::ajax_blackList_post() is stored in the database without sanitization and rendered into an HTML data-note attribute without proper escaping. This allows an admin with blacklist privileges to inject arbitrary JavaScript that executes in the browser of any other admin who views the user management page.

Critical Impact

An authenticated administrator with blacklist privileges can achieve stored XSS, enabling session hijacking, privilege abuse, and administrative account compromise within the CMS.

Affected Products

• CI4MS versions prior to 0.31.4.0
• CodeIgniter 4-based CMS installations using the vulnerable UserController module
• Systems with RBAC configurations allowing blacklist privileges

Discovery Timeline

• 2026-04-08 - CVE-2026-39391 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-39391

Vulnerability Analysis

This stored XSS vulnerability (CWE-79) exists in the CI4MS user management functionality. The flaw occurs because user-supplied input in the blacklist note parameter is not properly sanitized before being stored in the database and is subsequently rendered into an HTML attribute without output encoding. The attack surface is limited to authenticated administrators who have been granted blacklist privileges, making this a privilege escalation vector within the administrative panel rather than an externally exploitable vulnerability.

The vulnerability requires user interaction—another administrator must view the user management page where the malicious note is displayed. When rendered, the injected JavaScript executes within the victim's browser context, potentially allowing the attacker to steal session tokens, perform actions on behalf of the victim administrator, or further compromise the CMS.

Root Cause

The root cause is improper input validation and output encoding in the UserController::ajax_blackList_post() function. The blacklist note parameter is accepted from user input without sanitization and stored directly in the database. When the user management page retrieves and displays this data, the note content is inserted into an HTML data-note attribute without escaping special characters, allowing script injection.

Attack Vector

The attack vector is network-based and requires an authenticated attacker with administrative blacklist privileges. The attacker crafts a malicious JavaScript payload within the note field when blacklisting a user. This payload is stored persistently in the database. When any other administrator navigates to the user management interface and views the blacklisted user entry, the malicious script executes in their browser session. This enables session hijacking, credential theft, or manipulation of administrative functions on behalf of the victim.

The vulnerability exploits the trust relationship between administrators and the absence of content security policies or output encoding in the data attribute rendering logic. An attacker could inject payloads designed to exfiltrate session cookies, create new administrative accounts, or modify system configurations.

Detection Methods for CVE-2026-39391

Indicators of Compromise

• Unusual JavaScript code patterns in database fields associated with user blacklist notes
• Unexpected <script> tags, event handlers (e.g., onerror, onload), or encoded payloads in user management data
• Session anomalies indicating potential session hijacking of administrative accounts
• Audit log entries showing blacklist operations with suspicious note content

Detection Strategies

• Implement database query monitoring to detect malicious script patterns in the blacklist notes table
• Deploy Web Application Firewalls (WAF) with XSS detection signatures to identify injection attempts
• Configure Content Security Policy (CSP) headers to prevent inline script execution and report violations
• Review administrative audit logs for unusual blacklist activity or modifications

Monitoring Recommendations

• Enable verbose logging for the UserController::ajax_blackList_post() endpoint
• Monitor for CSP violation reports indicating attempted XSS exploitation
• Set up alerts for database writes containing HTML or JavaScript syntax in note fields
• Implement real-time session monitoring to detect session token anomalies

How to Mitigate CVE-2026-39391

Immediate Actions Required

• Upgrade CI4MS to version 0.31.4.0 or later immediately
• Audit existing blacklist note entries in the database for malicious content
• Implement Content Security Policy headers to mitigate XSS impact
• Review and restrict blacklist privileges to only essential administrative users

Patch Information

The vulnerability is fixed in CI4MS version 0.31.4.0. The patch implements proper input sanitization for the blacklist note parameter and ensures appropriate output encoding when rendering the data into HTML attributes. Organizations should update to the patched version as the primary remediation measure. For detailed patch information, refer to the GitHub Security Advisory.

Workarounds

• Implement server-side input validation to strip or encode HTML entities from note parameters before database storage
• Apply output encoding using CodeIgniter's esc() helper function when rendering user-supplied data in templates
• Deploy a Web Application Firewall with XSS filtering rules as a temporary protection layer
• Restrict blacklist privileges to a minimal set of trusted administrators until the patch is applied

If immediate patching is not possible, manually review and sanitize the UserController::ajax_blackList_post() function to ensure proper escaping. Implement the following defensive measures in your CodeIgniter 4 configuration:

// In app/Config/ContentSecurityPolicy.php
// Enable strict CSP to mitigate XSS impact
public $scriptSrc = "'self'";
public $reportOnly = false;

// In templates rendering user data
// Always use esc() helper for output encoding
<?= esc($note, 'attr') ?>