Missing Authentication Vulnerability in IceCMS Affects User Management

CVE-2026-111673

What is CVE-2026-111673?

IceCMS versions up to 4.1.5 are exposed to a vulnerability that allows unauthenticated attackers to gain unauthorized access to user accounts. This flaw arises from the exclusion of /User/** in the Shiro JWT filter, which permits attackers to send PUT requests to the /User/updateUser endpoint. Such requests can modify user roles and passwords, leading to potential full account takeovers, including that of administrative accounts.

References