CI4MS allows malicious JavaScript to be entered into group and role management fields, where it is stored on the server and later rendered unsafely within privileged administrative views. This stored cross‑site scripting can execute arbitrary code in the browser context of any administrator, allowing complete account takeover and full privilege escalation. The vulnerability arises from a failure to sanitize user-controlled input and output encode the data when displayed in the role management interface.

All installations of CI4MS built on CodeIgniter 4 and released prior to version 0.31.0.0 are affected. The issue has been patched in 0.31.0.0, so any version earlier than that must be upgraded.

The vulnerability scores a CVSS of 9.1, indicating critical severity, yet its EPSS score is below 1 %, suggesting a low likelihood of active exploitation at present. It is not listed in the CISA KEV catalog. The attack path is inferred to require authenticated access to the group and role management interface, typically granted only to administrators. An attacker who can log in as an administrator can inject the payload, which then executes in subsequent sessions of any administrator who loads the affected page. The exploit is straightforward once authenticated, but the prerequisite of admin credentials limits the overall attack surface.