The vulnerability arises from missing authentication on a critical function in ci4ms before version 0.31.4.0. The install route guard depends on a volatile cache check combined with the existence of a .env file to prevent post-installation access to the setup wizard. When the database is unreachable during a cache miss (due to TTL expiry or cache clearing), the guard fails open, enabling unauthenticated attackers to overwrite the .env file with attacker-controlled database credentials. This results in complete compromise of the application. The issue is classified under CWE-306 (Missing Authentication for Critical Function).

Successful exploitation allows an unauthenticated attacker to overwrite the .env file with arbitrary database credentials, resulting in full application takeover. This compromises confidentiality, integrity, and availability of the affected system. The CVSS v3.1 score is 8.1 (High), reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Upgrade ci4ms to version 0.31.4.0 or later, where this vulnerability is fixed. Since no official patch link or advisory is provided, users should verify the version and apply the update accordingly. Patch status is not yet confirmed via vendor advisory; however, the description explicitly states the issue is fixed in 0.31.4.0. Until upgraded, restrict access to the install route and monitor for unusual activity related to .env file modifications.