CI4MS Stored DOM XSS Flaws Enable Account Takeover and Privilege Escalation
Vulnerability Disclosure · 8 sources · Updated 4mo ago · First seen Mar 30, 2026
Two high-severity vulnerabilities in CI4MS, a CodeIgniter 4-based CMS skeleton, allow authenticated low-privilege users to trigger stored DOM-based XSS that can lead to full account takeover across roles and privilege escalation. CVE-2026-34558 affects the Methods Management functionality, where improperly sanitized and encoded user input can be stored server-side and later executed in administrative interfaces and global navigation components.
A second flaw, CVE-2026-34565, impacts Menu Management for posts, where malicious post data added to navigation menus can execute in both admin dashboards and public-facing menus. Both issues are classified as CWE-79 and carry the same CVSS v3.1 vector, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L; they affect CI4MS versions prior to 0.31.0.0 and were patched in 0.31.0.0.
