CVE-2026-39393

CVE-2026-39393 is an authentication bypass vulnerability affecting CI4MS (CodeIgniter 4 CMS) versions prior to 0.31.4.0. The vulnerability exists in the installation route guard mechanism, which relies on a volatile cache check and .env file presence to prevent post-installation access to the setup wizard. When the database becomes temporarily unreachable and cache expires, an unauthenticated attacker can exploit the failed guard to access the setup wizard and overwrite the .env file with malicious database credentials, resulting in complete application compromise. The vulnerability has a CVSS score of 8.1 (HIGH) with a network attack vector, high attack complexity, and no privilege or user interaction requirements. The impact is severe, affecting confidentiality, integrity, and availability of the affected system. An attacker can achieve full application takeover by injecting arbitrary database credentials. There is currently no evidence of active exploitation in the wild. The vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and shows an EPSS score of 0.00036, indicating very low probability of exploitation attempts. Community attention appears minimal, with the vulnerability rated 49.0/100 on the FAUCET risk scale. Patching to version 0.31.4.0 or later is recommended to remediate the risk.