The vulnerability arises from improper neutralization of input in the blacklist note parameter, which is stored in the database and rendered into an HTML data-note attribute without proper escaping. This enables an admin with blacklist privileges to perform a stored cross-site scripting attack against other admins. The issue affects ci4ms versions before 0.31.4.0 and is resolved in 0.31.4.0.

Successful exploitation allows an attacker with blacklist privileges to execute arbitrary JavaScript in the context of other admins' browsers when they access the user management page. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions within the admin interface. The CVSS score of 4.8 reflects a medium severity with network attack vector, low attack complexity, high privileges required, and user interaction needed.

Upgrade ci4ms to version 0.31.4.0 or later, where the vulnerability is fixed. Since the vendor advisory confirms the fix in 0.31.4.0, applying this official update is the recommended remediation. No additional mitigations are specified or required.