CVE-2026-41890

The deleteProcess() action accepts a POST parameter tables[] containing arbitrary table names. These are passed directly to $forge->dropTable() without validating that the tables belong to the theme being deleted.

The deleteConfirm view correctly populates tables[] from the theme's own migration files, but the server-side deleteProcess does not verify the received values against those files. An authenticated admin can craft a POST request with arbitrary table names and drop any table in the database.

This is a real bug even within the admin trust model: the action should be scoped to the theme's own tables. The permission grants delete this theme's data", not "drop any table".

Details

Location

modules/Theme/Controllers/Theme.php :: deleteProcess() ~line 147

Vulnerable Code

public function deleteProcess(string $slug)
{
    $themeName = $slug;
    $activeTheme = setting('App.siteTheme');
    if ($activeTheme === $themeName) {
        return redirect()->route('templateSettings')...;
    }

    $tablesToDrop = $this->request->getPost('tables');  // ← user-supplied, unvalidated
    if (!empty($tablesToDrop) && is_array($tablesToDrop)) {
        $forge = \Config\Database::forge();
        $db    = \Config\Database::connect();
        foreach ($tablesToDrop as $table) {
            if ($db->tableExists($table)) {
                $forge->dropTable($table, true);  // ← no whitelist check
            }
        }
    }

PoC

1. Authenticate to the backend (any user with theme.delete permission)
2. POST to /backend/themes/delete-process/<any_non_active_theme_slug>
3. Include tables[]=<any_table> in POST body
4. The named tables are dropped without validation

Additional note

Quick note on the design intent for deleteProcess, I noticed delete_confirm.php scopes the checkboxes to the theme's own migration files, and the CHANGELOG confirms the selective deletion was intentional (admins can choose which tables to keep). The server-side deleteProcess already has all the information it needs to validate the input, deleteConfirm derives the valid table set from the migration files, deleteProcess just needs to do the same before acting on the POST. Happy to clarify if useful.

• Dropped ci4ms_blog (confirmed in test)
• Dropped ci4ms_users + ci4ms_auth_identities simultaneously, disables all authentication (confirmed)
• Any table in the database can be targeted

The application does not adequately validate input before processing it, allowing unexpected values to reach sensitive code paths. Typical impact: varies by context: data corruption, logic bypass, or denial of service.

Kodem intelligence

1. What is CVE-2026-41890? CVE-2026-41890 is a medium-severity improper input validation vulnerability in ci4-cms-erp/ci4ms (composer), affecting versions >= 0.31.1.0, <= 0.31.7.0. It is fixed in 0.31.8.0. The application does not adequately validate input before processing it, allowing unexpected values to reach sensitive code paths.
2. Which versions of ci4-cms-erp/ci4ms are affected by CVE-2026-41890? ci4-cms-erp/ci4ms (composer) versions >= 0.31.1.0, <= 0.31.7.0 is affected.
3. Is there a fix for CVE-2026-41890? Yes. CVE-2026-41890 is fixed in 0.31.8.0. Upgrade to this version or later.
4. Is CVE-2026-41890 exploitable, and should I be worried? Whether CVE-2026-41890 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-41890 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-41890? Upgrade ci4-cms-erp/ci4ms to 0.31.8.0 or later.