CVE-2026-111673
Received Received - Intake

Unauthenticated Account Takeover in IceCMS

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any userId, including administrators, enabling full account takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111673
EUVD
EUVD-2026-102964

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Thecosy IceCMS 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

IceCMS through version 4.1.5 has a missing authentication vulnerability. Unauthenticated attackers can exploit this by sending PUT requests to /User/updateUser to change passwords and roles for any user, including administrators. This allows full account takeover because the /User/** path is excluded from the Shiro jwt filter.

Detection Guidance

Check for unauthenticated PUT requests to /User/updateUser endpoints. Monitor for unusual account modifications or password changes without prior authentication. Inspect Shiro jwt filter configurations for improper exclusion of /User/** paths.

Impact Analysis

Attackers can take over any account, including admin accounts, by setting new passwords and roles. This leads to unauthorized access, data manipulation, or complete system compromise. Sensitive data may be exposed or altered, and the system could be disabled entirely.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to personal or health data. GDPR requires protecting personal data, and HIPAA mandates safeguarding health information. A breach could result in legal penalties, fines, and loss of compliance certifications.

Mitigation Strategies

Remove /User/** from Shiro jwt filter exclusions. Implement strict authentication for all /User/** endpoints. Apply input validation to prevent unauthorized user modifications. Update to a patched version of IceCMS if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111673. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart