CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Date: 2026-04
Affected: composer/ci4-cms-erp/ci4ms
Attack vector: xss
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-34989
CWE: CWE-269
CWE-79
CVSS: 9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)

## Summary ### **Vulnerability 1: Stored DOM XSS via Profile Name Update (Persistent Payload Injection)** - Stored Cross-Site Scripting via Unsanitized User Name in Profile Management ### Description The application fails to properly sanitize user-controlled input when users update their profile name (e.g., full name / username). An attacker can inject a malicious JavaScript payload into their profile name, which is then stored server-side. This stored payload is later rendered unsafely in multiple application views without proper output encoding, leading to stored cross-site scripting (XSS). ### Affected Functionality - Profile name / full name update functionality (both the 2 user inputs) - User profile storage and retrieval logic ### Attack Scenario - An attacker updates their profile name to include a malicious XSS payload. - The application stores this value without sanitization or encoding. - The payload persists and executes whenever the name is rendered in affected views. ### Impact - Persistent Stored XSS - Execution of arbitrary JavaScript in victims’ browsers - Foundation for privilege escalation and account takeover when viewed by privileged users & normal ones across blogs and public facing pages that show user profiles full names Endpoint: `/backend/users/profile/` ### **Vulnerability 2: Stored XSS via User Name Rendering Across Multiple Endpoints (Privilege Escalation)** (Required for the chain) - Stored XSS via Unsafe Rendering of User Names Across Admi


Mitigations:

Architectural layers (MAESTRO):