CI4MS incorporated a FileEditor module that contains hidden items. An attacker who can bypass the RBAC checks can read secret files and modify protected files, thereby compromising confidentiality and integrity of the system. The weakness is mapped to CWE‑285, indicating an unauthorized access vulnerability.

The vulnerability affects installations of CI4MS—an open‑source CodeIgniter 4 based CMS skeleton—running any version prior to 0.31.4.0. The affected vendor is Ci4‑Cms‑Erp. Current users should verify that their deployment is at or above this version.

The CVSS score of 6.7 reflects a moderate severity. EPSS information is not available, and the issue is not listed in the CISA KEV catalog, suggesting limited current exploitation. The likely attack vector is through the web interface; an attacker must obtain a user session that can reach the FileEditor or exploit a flaw that reveals hidden items. Once the authorization check is bypassed, the attacker can read sensitive configuration or application files and overwrite critical protected files.