CVE-2026-41891: CI4-CMS-ERP CI4MS

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. From version 0.26.0 to before version 0.31.8.0, the auth filter has the deactivated/banned user check commented out. This issue has been patched in version 0.31.8.0.

Affected products

• CI4-CMS-ERP CI4MS: from 0.26.0, before 0.31.8.0 (fixed in 0.31.8.0)

Published 2026-05-07. Last modified 2026-06-17.