Live › vulnerability › CVE-2026-111673
Go to dashboardIceCMS (Thecosy) through 4.1.5 has no Shiro filter entry for /User/**, so the whole backend UserController runs unauthenticated. An attacker can send PUT /User/updateUser to set any userId's password and role (admin takeover). DELETE /User/deleteUser/{id} deletes any account, and POST /User/userDisableById disables any account. CVSS v4 9.3. No patched release exists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| IceCMS | vendor | <= 4.1.5 | – |
Check ShiroConfig.java (IceCMS-ment/.../configuration/) for a filterMap entry for /User/**; if it is absent your build is exposed. As a test on your own instance, an unauthenticated PUT /User/updateUser with a JSON body returning a success message means it is exposed. Review the user table for unexpected password or role changes, and for deleted or disabled accounts.
No fixed version known; the project publishes no releases and I found no upstream patch. Mitigate: add filterMap.put("/User/**", "jwt") plus a role check, and make JwtFilter reject empty Authorization headers. Or block /User/updateUser, /User/deleteUser and /User/userDisableById at the reverse proxy and keep the backend off the public internet. Reset admin passwords if tampering is suspected.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any userId, including administrators, enabling full account takeover.
This page as .md · .json · in your agent: get_signal("CVE-2026-111673")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.