{"id":"GHSA-vgrf-pr28-vf98","aliases":["CVE-2026-41890"],"title":"CI4MS Vulnerable to Arbitrary Database Table Drop via Theme deleteProcess","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"### Summary\nThe `deleteProcess()` action accepts a POST parameter `tables[]` containing arbitrary table names. These are passed directly to `$forge->dropTable()` without validating that the tables belong to the theme being deleted.\n\nThe `deleteConfirm` view correctly populates `tables[]` from the theme's own migration files, but the server-side `deleteProcess` does not verify the received values against those files. An authenticated admin can craft a POST request with arbitrary table names and drop any table in the database.\n\nThis is a real bug even within the admin trust model: the action should be scoped to the theme's own tables. The permission grants  delete this theme's data\", not \"drop any table\".\n\n### Details\n\n### Location\n`modules/Theme/Controllers/Theme.php` :: `deleteProcess()` ~line 147\n\n### Vulnerable Code\n```php\npublic function deleteProcess(string $slug)\n{\n    $themeName = $slug;\n    $activeTheme = setting('App.siteTheme');\n    if ($activeTheme === $themeName) {\n        return redirect()->route('templateSettings')...;\n    }\n\n    $tablesToDrop = $this->request->getPost('tables');  // ← user-supplied, unvalidated\n    if (!empty($tablesToDrop) && is_array($tablesToDrop)) {\n        $forge = \\Config\\Database::forge();\n        $db    = \\Config\\Database::connect();\n        foreach ($tablesToDrop as $table) {\n            if ($db->tableExists($table)) {\n                $forge->dropTable($table, true);  // ← no whitelist check\n            }\n        }\n    }\n```\n\n### PoC\n1. Authenticate to the backend (any user with theme.delete permission)\n2. POST to `/backend/themes/delete-process/<any_non_active_theme_slug>`\n3. Include `tables[]=<any_table>` in POST body\n4. The named tables are dropped without validation\n\n### Impact\n- Dropped `ci4ms_blog` (confirmed in test)\n- Dropped `ci4ms_users` + `ci4ms_auth_identities` simultaneously — disables all authentication (confirmed)\n- Any table in the database can be targeted\n\n### Additional note\nQuick note on the design intent for deleteProcess — I noticed delete_confirm.php scopes the checkboxes to the theme's own migration files, and the CHANGELOG confirms the selective deletion was intentional (admins can choose which tables to keep). The server-side deleteProcess already has all the information it needs to validate the input — deleteConfirm derives the valid table set from the migration files, deleteProcess just needs to do the same before acting on the POST. Happy to clarify if useful.","severity":"medium","score":6.9,"published":"2026-05-04T20:50:10.000Z","modified":"2026-05-08T20:33:36.536Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"ci4-cms-erp/ci4ms","sources":[{"name":"OSV · GHSA-vgrf-pr28-vf98","url":"https://osv.dev/vulnerability/GHSA-vgrf-pr28-vf98"}],"ranges":[{"events":[{"introduced":"0.31.1.0"},{"fixed":"0.31.8.0"}],"type":"ECOSYSTEM"}],"versions":["0.31.1.0","0.31.2.0","0.31.3.0","0.31.4.0","0.31.5.0","0.31.6.0","0.31.7.0"],"fixed":["0.31.8.0"]}],"sourceAffected":[],"references":["https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-vgrf-pr28-vf98","https://nvd.nist.gov/vuln/detail/CVE-2026-41890","https://github.com/ci4-cms-erp/ci4ms/commit/2f38284281ce6b435ea42003951f14109ac2cea7","https://github.com/ci4-cms-erp/ci4ms","https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.8.0"],"sources":[{"name":"OSV","id":"GHSA-vgrf-pr28-vf98","modified":"2026-05-08T20:33:36.536502Z","url":"https://osv.dev/vulnerability/GHSA-vgrf-pr28-vf98"}],"assessments":[{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":6.9}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T22:35:31.831Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}