CI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Date: 2026-04
Affected: composer/ci4-cms-erp/ci4ms
Attack vector: xss
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-34557
CWE: CWE-79
CVSS: 9.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L)

## Summary ### **Vulnerability: Stored DOM XSS via Group / Role Management Fields (Administrative Context Execution)** - Stored Cross-Site Scripting via Unsanitized Group / Role Management Inputs ### Description The application fails to properly sanitize user-controlled input within group and role management functionality. Multiple input fields (three distinct group-related fields) can be injected with malicious JavaScript payloads, which are then stored server-side. These stored payloads are later rendered unsafely within privileged administrative views without proper output encoding, leading to stored cross-site scripting (XSS) within the role and permission management context. ### Affected Functionality - Group creation and editing functionality - Role and permission assignment interfaces - Storage and retrieval of group-related data ### Attack Scenario - An attacker injects a malicious XSS payload into one or more group-related input fields. - The application stores these values without sanitization or encoding. - An administrator views the group or role management interface. - The payload executes automatically in the administrator’s browser. ### Impact - Persistent Stored XSS - Execution of arbitrary JavaScript in victims’ browsers - Privilege escalation when viewed by administrators - Full administrator account takeover - Full compromise of the entire application Endpoints: - `/backend/users/groupList/` ## Steps To Reproduce (POC) 1. Navigate to the Group / Role


Mitigations:

Architectural layers (MAESTRO):